Miguel Gómez

توجد ثغرة حقن SQL في سير عمل استيراد المشاركين في أرشيف الاستطلاع وتصدير استجابات SPSS. يمكن للمستخدم المصرح له والذي يمتلك صلاحية `surveys.create` العالمية استيراد أرشيف .lsa مصمم خصيصاً. إذا قام ملف XML الخاص بالمشارك داخل هذا الأرشيف بإنشاء عمود سمة باسم خبيث، يقوم LimeSurvey بتمرير هذا الاسم إلى منشئ الاختيار في Yii أثناء عملية تصدير الاستجابات من استطلاع غير مجهول. وبما أن الأسماء التي تحتوي على أقواس يتم التعامل معها كتعابير SQL بدلاً من معرفات مقتبسة، فإن ذلك يسمح بتنفيذ أوامر SQL يتم التحكم فيها من قبل المهاجم بصلاحيات قاعدة بيانات التطبيق.

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin.

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions.

توجد ثغرة cross-site scripting مخزنة في مربع حوار تأكيد الصداقة. يمكن لعضو مصرح له بصلاحيات منخفضة حقن HTML في حقول الاسم الأول والأخير. عندما يقوم مستخدم مصرح له آخر بعرض الملف الشخصي والنقر على خيار Friends، يقوم التطبيق باستخدام دالة `html()` الخاصة بـ jQuery لوضع اسم العرض الذي تم فك تشفيره في نافذة منبثقة، مما يؤدي إلى تنفيذ التعليمات البرمجية التي يتحكم فيها المهاجم ضمن جلسة المستخدم.

An authenticated user with global Surveys: create permissions can store a value that breaks JavaScript execution within the `date min` attribute of a Date/Time question. The issue occurs because the software inserts this stored value into a single-quoted inline JavaScript literal without applying proper JavaScript-context encoding, leading to stored Cross-Site Scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browser of other users who render the affected question.

An authenticated user with permissions to create surveys can manipulate the REST survey-patching endpoint. While the system verifies the user's permission against the survey ID in the request URL, the persistence operations resolve target objects using global `qid` (question identifier) or `aid` (answer identifier) without verifying if these objects belong to the authorized survey. This allows a user to modify questions or answers belonging to another user's survey.

A reflected cross-site scripting issue exists on the administrative survey-participant CSV import result page. Reflected cross-site scripting occurs when an application includes untrusted data in a web page without proper validation or encoding, allowing an attacker to execute malicious scripts in the victim's browser.

A stored cross-site scripting (XSS) issue exists where a user with the delegated, non-system-administrator `admin manage users` permission can inject persistent HTML or JavaScript into a Profile Field Category title. Stored XSS occurs when a malicious script is permanently stored on the target server, which is then served to other users.

Cross-site Scripting (XSS) occurs in the administrative interface because the software fails to safely encode attacker-controlled content from a crafted `.lss` survey file when displaying import warnings.

An issue exists in the `index()` formula function where a low-privileged authenticated user with permissions to create or modify formula fields can provide an undocumented fourth argument. This argument is treated as a SQL template and interpolated directly into a PostgreSQL expression. The injected SQL is executed with the privileges of the Baserow PostgreSQL role during the recalculation of formula field values, bypassing the permissions of the authenticated application user.

An authenticated user possessing only the `settings:read` global permission can bypass authorization requirements to create new survey menu entries. This is achieved by directly invoking the POST '/index.php/admin/menuentries/sa/create' endpoint without the necessary `settings:update` privilege. Additionally, the endpoint allows the submission of menu IDs that are typically restricted to superadministrators, enabling unauthorized modifications to administrative navigation records.

An authenticated stored cross-site scripting issue exists in the replacement-fields dialog within the administrative question editor. Stored cross-site scripting occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing an attacker to execute malicious scripts in the browser of other users.

A stored cross-site scripting issue exists in the survey quota creation workflow. An authenticated user with low privileges who has permissions to create and manage surveys can inject and store malicious JavaScript within a quota message.

An authenticated reflected Cross-Site Scripting (XSS) issue exists in the user activation confirmation endpoint. The `action` query parameter is copied into the response and inserted into a hidden input attribute without proper HTML attribute encoding. Cross-Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

توجد ثغرة في البرمجة النصية عبر المواقع (XSS) المنعكسة بعد المصادقة في نقطة النهاية المنبثقة لمحرر HTML. تتم معالجة معلمات الاستعلام `text` و`name` باستخدام أداة تنقية القائمة السوداء، ثم يتم عرضها دون ترميز الإخراج المناسب للسياق. البرمجة النصية عبر المواقع هي تقنية يتم من خلالها حقن نصوص برمجية ضارة في مواقع الويب الموثوقة.