Timon Vogel

The issue allows a remote attacker, who is a publisher or admin, to obtain access to all records stored in the database and execute arbitrary SQL commands via Search, specifically through the `flt` parameter in the "StatisticsResults.aspx" page.

A Reflected Cross-Site Scripting (XSS) issue exists via any metadata filter field, for example, when searching within Default.aspx using the `r` or `fo` parameter. This allows for malicious scripts to be reflected off the server, potentially leading to the execution of unwanted actions on the client-side.

The issue allows attackers to call restricted functions and perform unauthenticated uploads via the "Upload2.ashx" endpoint or access content uploaded by other users through "View.aspx" after using "Ajax.asmx/SaveGrantAccessList".

The issue involves multiple Stored Cross-Site Scripting (XSS) vulnerabilities in various components, including Disclaimer, Search Function, Comments, Batch editing tool, Content Creation, Related Media, Create new user, and Change Username.

The issue allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the `ON` cookie. A brute-force attack can calculate a value that provides permanent access.

The issue allows directory traversal to read arbitrary local files through the GetFile.aspx page.

The issue discloses sensitive information related to the `ON` cookie, which can be found in the HTML source code for "Default.aspx" in certain situations, and the "WhoAmI" endpoint, which can lead to path disclosure.