Hongkun Zeng

An issue allows an attacker to read any file on the server that the web server's user can access when the AllowArbitraryServer configuration setting is set to true. This is related to the mysql.allow local infile PHP configuration and the inadvertent ignoring of `options(MYSQLI OPT LOCAL INFILE)` calls.

An issue allows an attacker to gain access to the admin panel or a customer account when using the password reset function. This can be achieved by owning a domain name similar to the one the victim uses for their e-mail accounts.

A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.

The issue allows remote attackers to modify the password reset address link by manipulating the HTTP Host header when it is not part of the web server routing process.

The issue allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension. This can be achieved by uploading a ZIP file with a file that has an extension such as `.php.txt` or `.php%20`.

The issue allows users to scan ports of internal networks via SSRF, affecting private networks such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16, when media file fetching is enabled. This is due to the `sendRequest` method in the `HTTPClient` Class in the file `/inc/HTTPClient.php` having no access restrictions.

The issue allows a remote unauthenticated attacker to change the hostname in the password-reset URL via the HTTP Host header, potentially leading to phishing attacks. This can be triggered if the Host header is not part of the web server routing process, such as when multiple domains are served by the same web server.