Riccardo Krauter

The issue allows remote attackers to execute arbitrary commands. This is achieved via the `m1 sortby` parameter to the "modules/News/function.admin articlestab.php" endpoint.

The issue allows remote authenticated attackers to gain a webshell via a crafted phar file. This is achieved through a file upload vulnerability.

The issue allows an attacker to execute arbitrary commands on the remote server due to a path traversal vulnerability. This occurs when the `homedirs` option is used.

O problema diz respeito a uma injeção de SQL no arquivo modules/News/function.admin articlestab.php. Especificamente, a variável `$sortby` é concatenada com `$query1`, permitindo a injeção de código SQL arbitrário sem o uso do caractere ‘.’.

A vulnerabilidade permite a traversal de diretórios, podendo levar à execução remota de código. Isso pode ocorrer ao enviar um arquivo txt especialmente criado para o diretório lib, devido a uma chamada `wfu include lib`.

An issue in Total.js CMS allows an authenticated user with the Pages privilege to conduct a path traversal attack to include .html files outside the permitted directory. If a page contains a template directive, it will be server-side processed, potentially leading to Remote Command Execution if a user can control the content of a .html file and inject a malicious template directive.

A security issue in Total.js CMS allows a low-privilege user to transform a cookie and obtain the random values inside it. If an attacker discovers a session cookie owned by an admin, they can brute force it with reduced complexity, potentially leading to the theft of the admin password.

An issue allows an authenticated user with the widgets privilege to achieve Remote Command Execution (RCE) on the remote server. This is done by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server-side. The back-end's evaluation of the tag allows an attacker to escape the sandbox object using a specific payload: `<script total>global.process.mainModule.require(child process).exec(RCE);</script>`.

An issue in Total.js CMS allows an authenticated user with limited privileges to access a resource they do not own by calling the associated "API". The product manages privileges correctly only for the front-end resource path, but not for "API" requests, leading to vertical and horizontal privilege escalation.