Özkan Mustafa Akkuş

**Name of the Vulnerable Software and Affected Versions** Servisnet Tessa version 0.0.2 **Description** An issue was discovered that allows an attacker to obtain sensitive information. This can be achieved via a "/js/app.js" request. **Recommendations** For Servisnet Tessa version 0.0.2, consider restricting access to the "/js/app.js" endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Servisnet Tessa version 0.0.2 **Description** An issue was discovered where authorization data is available via an unauthenticated request to the "/data-service/users/" API endpoint. **Recommendations** For Servisnet Tessa version 0.0.2, consider restricting access to the "/data-service/users/" API endpoint to prevent unauthorized access to authorization data until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Servisnet Tessa version 0.0.2 **Description** An issue was discovered that allows an attacker to add a new sysadmin user via a manipulation of the `Authorization` HTTP header. **Recommendations** For Servisnet Tessa version 0.0.2, consider restricting access to the Authorization HTTP header to prevent manipulation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ericsson Network Location versions prior to 2021-07-31 **Description** The issue allows an authenticated attacker to inject commands via the `file name` in the export functionality. This could potentially be used to create a new admin user. **Recommendations** For versions prior to 2021-07-31, consider restricting access to the export functionality until a fix is available. As a temporary workaround, avoid using the `file name` parameter in the export functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netsia SEBA+ versions 0.16.1 and earlier, specifically build 70-e669dcd7 **Description** The issue allows remote attackers to discover session cookies via a direct "/session/list/allActiveSession" API endpoint request. This can lead to the discovery of the admin's cookie if the admin account is logged in when the request occurs, allowing the attacker to use that cookie immediately for admin access. **Recommendations** For Netsia SEBA+ versions 0.16.1 and earlier, consider restricting access to the "/session/list/allActiveSession" API endpoint to minimize the risk of exploitation. As a temporary workaround, limit the use of admin accounts when the allActiveSession request may occur. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BT CTROMS Terminal OS Port Portal CT-464 **Description** An issue in the password-reset feature allows account takeover by disclosing the verification token. When a getverificationcode.jsp request is made, the token is sent not only to the user's registered phone number but also to the unauthenticated HTTP client. **Recommendations** For BT CTROMS Terminal OS Port Portal CT-464, consider disabling the password-reset feature temporarily until a fix is available to prevent account takeover. Restrict access to the getverificationcode.jsp request to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine Application Manager versions through 14.2 **Description** A SQL Injection issue exists in the jsp/NewThresholdConfiguration.jsp file via the `resourceid` parameter, allowing a low-authority user to gain SYSTEM authority on the server. This can lead to uploading a malicious file using the "Execute Program Action(s)" feature. **Recommendations** For Zoho ManageEngine Application Manager versions through 14.2, avoid using the `resourceid` parameter in the jsp/NewThresholdConfiguration.jsp file until a fix is available. As a temporary workaround, consider restricting access to the "Execute Program Action(s)" feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Webmin versions 1.882 through 1.921 **Description** An issue exists in the `password change.cgi` endpoint of the administration web interface. The `old` parameter is susceptible to command injection due to improper neutralization of special elements used in a command. This allows a remote attacker to execute arbitrary shell commands on the target system with root privileges without authentication by sending a malicious POST request. This issue was found in official builds distributed via Sourceforge. **Recommendations** Update Webmin to version 1.930 or later. As a temporary mitigation, disable the option to change expired passwords. Restrict access to the `password change.cgi` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine OpManager versions prior to build 14310 **Description** An issue allows bypassing the user password requirement, enabling command execution on the server. The password is constructed by appending '@opm' to the `username`. For instance, if the `username` is 'admin', the password would be 'admin@opm'. **Recommendations** For versions prior to build 14310, update to a version that includes the fix for this issue to prevent password bypass and unauthorized command execution. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine OpManager versions prior to 12.5 **Description** A SQL Injection issue exists in the jsp/NewThresholdConfiguration.jsp file via the `resourceid` parameter, allowing a low-authority user to gain SYSTEM authority on the server. This can lead to uploading malicious files using the "Execute Program Action(s)" feature. **Recommendations** For Zoho ManageEngine OpManager versions prior to 12.5, as a temporary workaround, consider restricting access to the jsp/NewThresholdConfiguration.jsp file and the "Execute Program Action(s)" feature until a patch is available. Avoid using the `resourceid` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Sahi Pro version 8.0.0 **Description** The issue allows command execution via the `Player setScriptFile` function in Sahi Pro. This enables running `.sah` scripts through Sahi Launcher and creating new scripts with an editor. It is also possible to execute commands on the server using the `execute()` function. **Recommendations** For Sahi Pro version 8.0.0, consider disabling the `execute()` function as a temporary workaround until a patch is available. Restrict access to the `Player setScriptFile` function to minimize the risk of exploitation. Avoid using the `Player setScriptFile` function in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** AROX School-ERP Pro (affected versions not specified) **Description** The issue concerns a command execution vulnerability. Specifically, the `import stud.php` and `upload file.php` files lack session control, allowing an unauthenticated user to execute commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webmin versions prior to 1.910 **Description** The issue allows any user authorized to the "Package Updates" module to execute arbitrary commands with root privileges. This is achieved via the `data` parameter to the "update.cgi" endpoint. **Recommendations** For versions prior to 1.910, update to version 1.910 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Package Updates" module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PHP-Fusion version 9.03.00 **Description** The issue allows remote authenticated users to execute arbitrary code. This is due to the mishandling of executable files during avatar upload in the includes/dynamics/includes/form fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc files. **Recommendations** For PHP-Fusion version 9.03.00, consider disabling the avatar upload feature until a patch is available to prevent the execution of arbitrary code. Restrict access to the edit profile.php file to minimize the risk of exploitation. Avoid using the vulnerable files includes/dynamics/includes/form fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Allied Telesis 8100L/8 devices (affected versions not specified) Description: The issue allows for cross-site scripting (XSS) attacks. This is possible due to the lack of proper input validation in the `vlanid` or `subnet mask` parameters within the `edit-ipv4 interface.php` endpoint. Recommendations: For Allied Telesis 8100L/8 devices, as a temporary workaround, consider restricting access to the `edit-ipv4 interface.php` endpoint until a patch is available. Avoid using the `vlanid` or `subnet mask` parameters in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** osTicket versions prior to 1.12 **Description** The issue exists due to the possibility of XSS via several API endpoints, including "/upload/file.php", "/upload/scp/users.php?do=import-users", and "/upload/scp/ajax.php/users/import", when an agent manager user uploads a crafted .csv file to the User Importer. This occurs because file contents can appear in an error message, potentially leading to local file inclusion. **Recommendations** For versions prior to 1.12, update to version 1.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the User Importer feature to minimize the risk of exploitation. Avoid using the User Importer to upload .csv files from untrusted sources until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine Applications Manager versions 12 through 14 **Description** The issue allows for SQL injection via the FaultTemplateOptions.jsp resourceid. This can be exploited by an unauthenticated user to gain SYSTEM authority on the server. The exploitation involves uploading a malicious file using the "Execute Program Action(s)" feature. **Recommendations** For versions 12 through 14, update to a version that contains a fix for this issue to prevent SQL injection and unauthorized access. As a temporary workaround, consider restricting access to the "Execute Program Action(s)" feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ATutor versions prior to 2.2.5 **Description** An issue in ATutor allows a user with teacher privileges to run commands on the server. The File Manager's Upload Files section contains an arbitrary file upload vulnerability via the "upload.php" endpoint. The `$IllegalExtensions` value is case-sensitive and only lists lowercase extensions, which can be bypassed by using uppercase extensions (e.g., `.phP`). Additionally, the value omits `.shtml` and `.phtml` extensions. **Recommendations** For ATutor versions prior to 2.2.5, update to version 2.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Upload Files section in the File Manager to prevent exploitation. Additionally, modify the `$IllegalExtensions` value to include both lowercase and uppercase extensions, as well as `.shtml` and `.phtml` extensions, to prevent bypasses.

**Name of the Vulnerable Software and Affected Versions** CutePHP CuteNews version 2.1.2 **Description** An issue allows an attacker to infiltrate the server through the avatar upload process in the profile area via the "index.php?mod=main&opt=personal" endpoint, by exploiting the `avatar file` field. The lack of effective control of `$imgsize` in `/core/modules/dashboard.php` enables an attacker to change the header content of a file, bypass controls, and potentially achieve code execution, for example, by using a GIF header. **Recommendations** For CutePHP CuteNews version 2.1.2, consider disabling the avatar upload feature in the profile area until a patch is available to prevent exploitation through the `avatar file` field in the "index.php?mod=main&opt=personal" endpoint. Restrict access to the `/core/modules/dashboard.php` module to minimize the risk of exploitation related to the `$imgsize` variable.

**Name of the Vulnerable Software and Affected Versions** OpenKM versions 6.3.2 through 6.3.7 **Description** The issue allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site. This is achieved by exploiting the Filesystem path control in the admin's Export field, specifically through the frontend/FileUpload and admin/repository export.jsp. As a result, attackers can gain remote code execution through the application server with root privileges. **Recommendations** For OpenKM versions 6.3.2 through 6.3.7, consider restricting access to the frontend/FileUpload and admin/repository export.jsp endpoints to minimize the risk of exploitation. Additionally, restrict the ability to upload and move files within the /okm:root directories to prevent malicious file uploads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.