Huy-Ngoc Dau

Existem várias vulnerabilidades SQL em diversos arquivos PHP, incluindo planning.php, user list.php, projets.php, user groupes.php e groupe list.php.

O problema diz respeito a várias vulnerabilidades de Cross-Site Scripting (XSS). Essas vulnerabilidades permitem que usuários mal-intencionados executem código arbitrário por meio do `document.cookie` em `nb mois` e `mb ligness` e do parâmetro GET de depuração em “export.php”.

The issue allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash. This is because Soplanning generates static links for sharing ICAL calendars with embedded login information.

A directory traversal issue exists in the file get contents function, allowing remote attackers to determine the existence of arbitrary files by using a .. (dot dot) in a URL path parameter.

The issue allows remote authenticated users to execute arbitrary PHP code via a crafted database name, given certain conditions such as access to an existing database, permissions to create arbitrary databases, the use of PHP before version 5.2, a down configuration database, or a non-writable smarty/templates c directory.