Mohab Ali

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users.

The issue allows remote attackers to execute arbitrary commands via the `adminPassword` parameter.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `where` parameter to "rss.php" or the `sqlQuery` parameter to "search.php".

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including `errorNo` and `errorMsg` in the error.php endpoint "/error.php", `viewType` in the duplicate manager.php endpoint "/duplicate manager.php", and multiple parameters in the query manager.php endpoint "/query manager.php", such as `queryAction`, `displayType`, `citeOrder`, `sqlQuery`, `showQuery`, `showLinks`, `showRows`, and `queryID`. Additionally, the `sourceText` and `sourceIDs` parameters in the import.php endpoint "/import.php", and the `typeName` and `fileName` parameters in the modify.php endpoint "/modify.php" are also vulnerable.

The issue allows remote attackers to conduct XML injection attacks. This can be achieved via two parameters: the `id` parameter to the "unapi.php" endpoint or the `stylesheet` parameter to the "sru.php" endpoint.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the `referrer` parameter. This can be exploited to trick users into revealing sensitive information.