Hackchang

**Name of the Vulnerable Software and Affected Versions** HortusFox (hortusfox-web) versions prior to 6.2 **Description** An SQL injection issue exists where API token holders can execute arbitrary SQL commands. By providing crafted values to the `include info` variable at the '/api/locations/list' endpoint, attackers can insert subqueries that the `getSpecificInfo()` function in PlantsModel concatenates into the column list. This allows for the unauthorized reading of any database table, including user password hashes. **Recommendations** Update HortusFox (hortusfox-web) to version 6.2 or later. As a temporary mitigation, restrict access to the '/api/locations/list' endpoint or avoid using the `include info` parameter.

**Name of the Vulnerable Software and Affected Versions** HortusFox (hortusfox-web) versions prior to 6.4 **Description** An unrestricted file upload issue exists in the `PlantAttachmentModel` that allows authenticated users to store files with client-supplied extensions in the `public/attachments/` directory. By using the '/plants/attachments/add' endpoint, attackers can upload HTML or SVG files to perform stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the server and served to other users. Additionally, if `.htaccess` is unenforced, PHP files can be uploaded to execute arbitrary code on the server. **Recommendations** Update HortusFox (hortusfox-web) to version 6.4 or later. Restrict access to the '/plants/attachments/add' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SigNoz versions 0.88.0 through 0.142.0 **Description** Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the `service name` and `span name` fields into ClickHouse string literals without proper escaping. **Recommendations** Update SigNoz to version 0.142.1.

**Name of the Vulnerable Software and Affected Versions** SigNoz versions 0.88.0 through 0.141.0 **Description** The HTTP handler fails to apply authorization wrappers to trace-funnel analytics endpoints. This allows unauthenticated attackers to submit arbitrary funnel definitions to retrieve trace analytics, including identifiers, durations, span counts, service topology, and error activity, without providing credentials. **Recommendations** Update SigNoz to a version later than 0.141.0.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات @acastellon/auth الأقدم من 2.3.0 **الوصف** يوجد ثغرة لتجاوز المصادقة في البرمجيات الوسيطة `validateToken()`. تنشأ المشكلة من الثقة غير الصحيحة في رؤوس الطلبات القابلة للتزوير والتحكم المعيب في تدفق الطلبات، مما يسمح باستدعاء الدالة `next()` قبل اكتمال فحوصات المصادقة. على وجه التحديد، يتم تشغيل تجاوز من خدمة إلى خدمة عندما يتم تعيين رأس `auth-user` إلى `service-brother` ويبدأ رأس `Host` بالقيمة التي تُرجعها الدالة `getHostName()`. ونظرًا لأن رأسَي `auth-user` و`Host` يخضعان لسيطرة العميل، يمكن لمهاجم بعيد غير مصدق عليه صياغة هذين الرأسين لتجاوز التحقق من صحة الرموز القديمة أو رموز JWT أو OIDC، مما قد يؤدي إلى الوصول غير المصرح به، وتصعيد الامتيازات، والتنقل الأفقي. **التوصيات** التحديث إلى الإصدار 2.3.0.