Qianqiu

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."

**Name of the Vulnerable Software and Affected Versions** athlon1600 youtube-downloader versions prior to 4.0.2 **Description** Remote attackers can perform server-side request forgery (SSRF) by manipulating the `url` argument within the `stream()` function located in the public/stream.php file. Server-side request forgery is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Update athlon1600 youtube-downloader to a version newer than 4.0.1. As a temporary workaround, restrict access to the `stream()` function in the public/stream.php file.

**Name of the Vulnerable Software and Affected Versions** amirsanni Mini-Inventory-and-Sales-Management-System versions up to 81bf0b55f5933f3b0dbb1583204a612e06605b95 **Description** A security flaw in the Database Query Builder component allows remote exploitation via SQL injection. The issue occurs when the `orderBy` argument is manipulated within the `order by()` function of the `DB query builder.php` file. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Simple Task List version 1.0 **Description** A critical issue has been found in the software, affecting the `insertUserRecord` function of the `signUp.php` file. The manipulation of the `username` argument leads to SQL injection. This issue can be exploited remotely. **Recommendations** For Simple Task List version 1.0, as a temporary workaround, consider disabling the `insertUserRecord` function until a patch is available. Restrict access to the `signUp.php` file to minimize the risk of exploitation. Avoid using the `username` argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.