Yunshen

**اسم البرنامج المصاب والإصدارات المتأثرة** itsmeravitejak Online-Examination-System الإصدارات حتى e6208e630b14657999bbfe4c9912302d2a1e2449 **الوصف** يوجد ضعف في وظيفة غير معروفة داخل ملف `dbtables.sql` يسمح بإجراء تلاعب عن بُعد، مما قد يؤدي إلى كشف المعلومات. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذا الضعف.

**Name of the Vulnerable Software and Affected Versions** iWebShop-5 versions prior to 5.16 **Description** A missing authorization issue exists in the `Update::index()` function within the `controllers/update.php` file. This flaw allows remote attackers to perform unauthorized actions by manipulating the request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `Update::index()` function in the `controllers/update.php` file.

**Name of the Vulnerable Software and Affected Versions** iWebShop-5 versions prior to 5.16 **Description** A flaw in the `upload json/uploadFile` function within the `controllers/pic.php` file allows for unrestricted file upload. This issue can be exploited remotely to upload arbitrary files to the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `upload json/uploadFile` function in the `controllers/pic.php` file.

**Name of the Vulnerable Software and Affected Versions** iWebShop-5 versions prior to 5.16 **Description** A remote SQL injection occurs when the `Search` argument is manipulated within the `member list()` function located in the controllers/member.php file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to interfere with the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `member list()` function in the controllers/member.php file.