Rastating

The issue allows an attacker to upload a file with a dangerous type via the moveAction function in core/controllers/fm.php. This can be achieved by using the admin/media upload and fm/move endpoints.

The issue allows for XSS in blog-list.php, affecting both the gila-blog and gila-mag themes, via the `search` parameter.

The issue allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. This can be exploited by sending requests with varying `X-Forwarded-For` or `Client-IP` headers to the affected system.

An issue was discovered in the sign-up page available at /index.php?page=signup, where the `act` parameter is vulnerable to reflected cross-site scripting.

An issue was discovered in the search function available at "/index.php?page=forums&action=search", where the `keywords` parameter is vulnerable to reflected cross-site scripting.

An issue was discovered where the hashed passwords stored in the `xbtit users` table are stored as unsalted MD5 hashes. This makes it easier for attackers to obtain cleartext values via a brute-force attack.

An issue was discovered due to a lack of cross-site request forgery protection, making it possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf.

An issue was discovered where the `returnto` parameter of the login page is vulnerable to an open redirect due to a lack of validation. If a user is already logged in when accessing the page, they will be instantly redirected.

An issue in BTITeam XBTIT allows PHP error logs to be stored in an open directory (/include/logs) with predictable file names. This can lead to full path disclosure and the leakage of sensitive data.

An issue was discovered that allows XSS via the `id` parameter in the "news.php" endpoint.

An issue was discovered where the password hash of a user is rehashed using a predictable salt and stored in the `pass` cookie, which is not flagged as HTTPOnly. This allows an attacker who steals the cookie to efficiently brute-force it and retrieve the user's cleartext password.

An issue was discovered that allows bypassing the anti-XSS mechanism in includes/crk protection.php. This is achieved by utilizing String.replace and eval, enabling the circumvention of the protection that normally looks for dangerous fingerprints.

The issue concerns a stored XSS exploit via the title of a news item in the newsfeed, accessible through the API endpoint "/index.php?page=viewnews". This exploit is also possible through CSRF.

The issue concerns hardcoded cookie and session secrets in the Express.js application, which are visible in the source code. An attacker can exploit this by editing the session cookie contents and re-signing it using the hardcoded secret, potentially leading to privilege escalation due to the use of Passport.js.

An issue was discovered related to the files config/environments/all.js and config/initializers/02 passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number of the account they wish to take over, and re-sign it using the hard-coded secret.