Jmrcsnchz

Caddy هي منصة خادم قابلة للتوسيع تستخدم بروتوكول TLS بشكل افتراضي. لا تستطيع دالة القالب `stripHTML`، وتحديدًا داخل الدالة `funcStripHTML()`، إزالة جميع علامات HTML من سلاسل الإدخال بشكل موثوق. يمكن لبعض علامات HTML المشوهة تجاوز منطق إزالة العلامات، مما قد يترك محتوى خطيرًا في المخرجات. إذا تم عرض هذه المخرجات لاحقًا كـ HTML، فقد يسمح ذلك بحدوث هجوم Cross-Site Scripting (XSS) من جانب العميل، حيث يمكن للمهاجم تنفيذ تعليمات JavaScript تعسفية في متصفح المستخدم.

The issue is related to insufficient input validation, which leads to cross-site scripting (XSS) in almost all input fields of the facileManager web application.

The issue concerns a modular suite of web apps built with the sysadmin in mind. In the affected versions, the `$ REQUEST` global array was unsafely called inside an `extract()` function in `admin-logs.php`. Although the PHP file `fm-init.php` prevents arbitrary manipulation of `$ SESSION` via the GET/POST parameters, it does not prevent manipulation of other sensitive variables such as `$search sql`. An authenticated user with privileges to view site logs can manipulate the `$search sql` variable by appending a GET parameter `search sql` in the URL. This renders the checks and SQL injection prevention attempts unusable.

The issue allows non-admin users to arbitrarily set their permissions and grant their non-admin accounts with super user privileges when updating their profile. This is done through a POST request containing user information sent to the endpoint "server/fm-modules/facileManager/ajax/processPost.php".

A command injection issue exists in WWBN AVideo, allowing Remote Code Execution when the CloneSite Plugin is used. This issue is related to the `plugin/CloneSite/cloneClient.json.php` endpoint. It is a bypass to a previous fix and is patched in a specific commit.

An OS Command Injection issue in the authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. The vulnerable code executes a command that includes user-controlled input, specifically the `cloneSiteURL` variable, which can be manipulated through the admin panel's clone site feature. By hosting a specially crafted `cloneServer.json.php` file, an attacker can inject malicious commands, leading to remote code execution. This issue is exploited by sending a GET request to the vulnerable endpoint.