Steffen Rösemann

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the `id` parameter to "project.php", the `group id` parameter to "group.php", the `status id` parameter to "status.php", the `resolution id` parameter to "resolution.php", the `severity id` parameter to "severity.php", the `priority id` parameter to "priority.php", the `os id` parameter to "os.php", or the `site id` parameter to "site.php".

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via several parameters, including the `project name` parameter to "project.php", the `use js` parameter to "user.php" and "group.php", the `Description` parameter to "status.php" and "severity.php", the `Regex` parameter to "os.php", and the `Name` parameter to "database.php".

The issue allows remote authenticated users to hijack the authentication of other users for various requests, including deleting data and causing unspecified impacts. This is achieved through multiple cross-site request forgery (CSRF) vulnerabilities. The affected API endpoints include "project.php" with the `id` parameter, "group.php" with the `group id` parameter, "status.php" with the `status id` parameter, "severity.php" with the `severity id` parameter, "priority.php" with the `priority id` parameter, "os.php" with the `os id` parameter, "database.php" with the `database id` parameter, and "sites.php" with the `site id` parameter.

The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different PHP files. The affected parameters include `srctrack`, `use mfs tmp size`, `use mfs var size`, `port`, `snaplen`, `count`, `pppoe resethour`, `pppoe resetminute`, `wpa group rekey`, `wpa gmk rekey`, `member[]`, `pkgrepourl`, `zone`, `cache max ttl`, `cache min ttl`, `sshport`, `id`, `tunable`, `descr`, `value`, `firmwareurl`, `repositoryurl`, `branch`, `pfsyncpeerip`, `synchronizetoip`, `username`, `passwordfld`, `maxmss`, `ntp server1`, `ntp server2`, `wins server1`, and `wins server2`. The API endpoints affected include "system advanced misc.php", "diag packet capture.php", "interfaces.php", "interfaces ppps edit.php", "interfaces qinq edit.php", "load balancer pool edit.php", "pkg mgr settings.php", "services captiveportal.php", "services dnsmasq.php", "services unbound.php", "services unbound advanced.php", "system advanced admin.php", "system advanced sysctl.php", "system firmware settings.php", "system hasync.php", "vpn ipsec settings.php", and "vpn openvpn csc.php".

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `search` parameter in a search action to "index.php".

The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in actions to index.php. This can be achieved through the `schtlr` parameter in a brands action or the `brand` parameter in a viewbrands action.

The issue allows remote attackers to obtain configuration information. This is achieved by accessing the admin/ endpoint with a getphpinfo action, which invokes the phpinfo function.

The issue concerns SQL injection vulnerabilities in the administrative backend. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. This can be achieved through the `id` parameter in either a `disporders` detail or `subadminmgt` edit action, or the `cid` parameter in an `editcurrency` action to `admin/`.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `page` parameter to "index.php" or the `id` parameter in a "users users" action to "asys/site/system.php".

The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to the `asys/site/files.php` endpoint, and then accessing it via a direct request to the file in `upload/files/`.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting a SQL injection vulnerability in the userprofile.lib.php file, specifically via the `user` parameter to the default URI.

The issue allows remote attackers to hijack the authentication of administrators for various requests, including deleting, deactivating, or activating modules, users, themes, events, and language settings, as well as modifying the autologin feature. This is achieved through multiple cross-site request forgery (CSRF) vulnerabilities in the administrator.php file. The vulnerable parameters include `delete module`, `deactivate module`, `activate module`, `delete user`, `deactivate user`, `activate user`, `set theme`, `delete`, `deactivate notification`, `activate notification`, `delete notification`, `deactivate language`, `activate language`, `delete language`, and parameters related to the autologin feature.

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the `search` parameter to "admin/user management.php", the `data search` parameter to "/admin/profile data.php", or the `filter` parameter to "error log.php".

The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the `user id` parameter in a Modify Account action.

The issue allows remote administrators to execute arbitrary code by uploading a file with an executable extension to the custom/uploads/ directory, and then accessing it via a direct request. This is due to an unrestricted file upload vulnerability.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters. The affected parameters include the `action` parameter in a search request, the `username` in a login request (which is not properly handled when logging the event), and the `page title` in an insert action.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the admin.php file. These vulnerabilities allow remote attackers to hijack the authentication of administrators, potentially leading to cross-site scripting (XSS), SQL injection, or unrestricted file upload attacks.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `p` parameter in an update action to the "admin.php" endpoint.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `page id` parameter in the "admin/pages/modify.php" endpoint.

A cross-site scripting (XSS) issue exists in the administrative backend, allowing remote attackers to inject arbitrary web script or HTML via the `path` parameter to "admin/file manager/file manager/editfile".