3265048908

**Name of the Vulnerable Software and Affected Versions** realjerrytang tacomall version 1.0.0 **Description** An improper authorization issue exists in the api-admin Backend component within the file ApiMaApplication.java. The flaw occurs in the `OrgStaffServiceImpl.add()` function, where manipulating the `isAdmin` or `jobId` arguments allows for remote exploitation. **Recommendations** For version 1.0.0, restrict the use of the `OrgStaffServiceImpl.add()` function or validate the `isAdmin` and `jobId` arguments to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** risesoft-y9 WorkFlow-Engine versions prior to 9.6.11 **Description** An issue exists in the OAuth2 Resource Filter component within the `getByIdAndYear()` function of the `CustomHistoricProcessServiceImpl.java` file. Manipulation of the `year` and `processInstanceId` arguments allows for remote SQL injection, where an attacker can interfere with the queries that an application makes to its database. The injection point is available in two independent positions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `getByIdAndYear()` function to minimize the risk of exploitation.