D. Fabian

The issue allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the `lang` parameter. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out by a remote attacker who has passed the authentication procedure.

Name of the Vulnerable Software and Affected Versions: Typo3 versions 3.7, 3.8, 4.0.0 through 4.0.3, and 4.1 beta with the rtehtmlarea extension Description: The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the `userUid` parameter to "rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php". Recommendations: For Typo3 versions 3.7, 3.8, 4.0.0 through 4.0.3, and 4.1 beta with the rtehtmlarea extension, avoid using the `userUid` parameter in the affected API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the rtehtmlarea extension to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via multiple vectors, including the `account name`. This can lead to the execution of malicious scripts on the client-side.

The issue allows remote attackers to upload arbitrary files, including PHP files, via the `add2db` action in the uploads module.

The issue allows remote attackers to execute arbitrary PHP code via an arbitrary file in the `templatename` parameter, which is passed to the `eval()` function.

The issue allows remote attackers to read or include arbitrary files and ultimately execute arbitrary PHP code via directory traversal vulnerabilities. This is achieved by using .. (dot dot) and null byte ("%00") sequences in the `module` parameter and `action` parameter in the Leads module. Attackers can also inject PHP code into log messages and access the log file.

The issue allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page. This is due to improper handling by the `fetch` function in the ` httpsrequest` function.