Łukasz Jaworski

Cross-Site Request Forgery (CSRF) exists in the 'groupe save' create, modify, and delete endpoints. This allows an attacker to craft a malicious website that, when visited by an authenticated user, automatically sends a forged GET or POST request to the application.

Lack of authorization enforcement for backup functionalities allows an unauthenticated attacker to query backup-related endpoints. This can lead to the retrieval of backup archives containing user databases with usernames and password hashes, as well as the `config.csv` file containing sensitive information.

An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate `user.csv` file and a malicious file. The server extracts these files without verifying the uploaded file extensions. When combined with a Path Traversal issue, the malicious file, such as a PHP script, can be placed in a web-accessible location and executed via the browser.

Path Traversal exists in backup endpoints, allowing an authenticated remote attacker to read and execute files previously added via the backup functionality. Additionally, a missing authorization issue allows any unauthorized user to read any backup file.

SQL Injection allows an attacker with low privileges to inject arbitrary SQL commands, which could lead to full control over the database.

Reflected Cross-Site Scripting (XSS) occurs when an application includes untrusted data in a web page without proper validation or escaping. An attacker can craft a malicious URL containing the `taches` parameter which, when opened by an authenticated victim, results in arbitrary JavaScript execution in the victim’s browser.

Stored Cross-Site Scripting (XSS) occurs via the '/process/upload backup' endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious `user.csv` file with embedded JavaScript. The injected code executes in the victim's browser when the Edit button for the malicious backup is clicked.

The PDF Export Module used in DHTMLX Gantt and Scheduler allows unauthenticated remote code execution. The issue stems from insufficient sanitization of the `data` parameter. An attacker can inject malicious JavaScript code into this parameter, which is then processed and executed by Node.js, potentially leading to full server compromise.

The PDF Export Module used in DHTMLX Gantt and Scheduler contains a path traversal flaw resulting from insufficient HTML sanitization. This allows an unauthenticated user to create a malicious HTML payload that includes local server files, which are then displayed within the generated PDF document.

The export module is susceptible to Path Traversal in the `src` attribute because of insufficient HTML sanitization. An unauthenticated attacker can craft a malicious HTML payload to read arbitrary local files from the server and include their content in the generated PDF.

SOPlanning is susceptible to a Broken Access Control issue in the `/status` endpoint. Insufficient permission checks within the Project Status functionality allow an authenticated attacker to modify any status by adding, editing, or deleting entries. The vulnerable parameter is not specified.

SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue within the `/feries` endpoint. A malicious actor with access to the public holidays feature can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when various pages are accessed. By default, access to this endpoint is limited to administrators and users with specific privileges.

SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue within the `/status` endpoint. An attacker possessing an account can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when other users access various pages.

SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue in the `/projets` API endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when an edited page is opened.

SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue within the `/taches` endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when the editor is opened.

SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue in the `/groupe form` endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when the editor is opened.

SOPlanning is susceptible to a weakness in its password recovery token generation process. The use of a weak mechanism for generating these tokens allows a malicious actor to potentially brute-force all possible values, leading to account takeover.