Jdexploit

A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".

**Name of the Vulnerable Software and Affected Versions** PHPGurukul Small CRM version 4.0 **Description** An issue exists in the Login Success Handler component within the `/crm/login.php` file. The `unserialize()` function fails to properly handle the `geopluginURL` argument, leading to deserialization. This allows a remote attacker to initiate an attack, although the complexity is high and exploitability is considered difficult. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `/crm/login.php` endpoint or avoid using the `geopluginURL` argument.