The_Storm

The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the full name or file title to accounts/admin/index.php, or the comment parameter in the support page to accounts/index2.php. API Endpoints: "accounts/admin/index.php" and "accounts/index2.php" are affected. Vulnerable Parameters or Variables: `full name`, `file title`, and `comment` are vulnerable.

A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of administrators for requests that add accounts via a new-client action. This occurs in the accounts/admin/index.php file.

The issue allows remote attackers to hijack the authentication of administrators for various requests. This can be achieved through multiple cross-site request forgery (CSRF) vulnerabilities. Specifically, attackers can change arbitrary user passwords via a `nouveau` action in the security module to "cars/ADMIN/index.php", create a user or create a sub-user via a `sub accounts` action in the home module to "USERS/index.php", or change profile information via an `edit` action in the profile module to "USERS/index.php".

The issue allows remote attackers to inject arbitrary web script or HTML via several fields, including the `PWRS` field, `Description` field when posting a new vehicle, `news title` when creating news, `Name` when creating a sub user, `group name` when creating a group, or `dealer name`, `first name`, or `last name` when changing a profile.

The issue allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension. This can be achieved by uploading a file such as `.php%00.jpg`.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that change account settings. This can lead to unauthorized changes to account settings.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `OTR HEADS[]` parameter in an edit action on the "admin/action/objects.php" endpoint.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `OB ID` parameter in a single action to "admin/action/objects.php", the `AREA ID` parameter in a single action to "admin/action/areas.php", or the `start` parameter in a show action to "admin/action/pdf.php".

The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the `root` parameter in the `/blogs/htsrv/viewfile.php` API endpoint.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the message body in blogs/blog1.php.

The issue allows remote attackers to inject arbitrary web script or HTML via a comment to the news, title to the news, or the folder names in a gallery.

A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that add user accounts.

The issue allows remote administrators to read arbitrary files via a full pathname in the `dir` parameter in a "contents/Files" action. This is due to an absolute path traversal vulnerability in the controlcenter.php file.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several API endpoints, including "holiday.php" and "holiday book.php" using the `hid` parameter, "pages.php" using the `id` parameter, "admin/airline-edit.php" using the `fid` parameter, and "admin/customer-edit.php" using the `cid` parameter.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests, including adding an agent via an `addagent` action or modifying an agent.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `view` parameter to "agentdisplay.php" or the `edit` parameter to "admin/admin.php".

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via several parameters, including `notes` to "admin/agenteditor.php", `title`, `previewdesc`, `fulldesc`, or `notes` to "agentadmin.php", or in an "addlisting" action to "agentadmin.php". Additionally, there are unspecified vectors to "admin/adminfeatures.php".

The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension using specific API endpoints, such as "airline-edit.php", "hotel-image-add.php", or "hotel-add.php".

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `holiday name` field to API endpoints such as "holiday add.php" or "holiday view.php".