Aaron Haymore

**Name of the Vulnerable Software and Affected Versions** RaspAP versions prior to 3.1.5 **Description** The issue is related to the restapi.service file (/lib/systemd/system/restapi.service) in RaspAP, a software for creating wireless routers based on Debian. It is caused by the lack of measures to neutralize special elements used in commands due to insufficient access restriction for the www-data user group. This can allow a remote attacker to escalate privileges and execute arbitrary commands. The www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password. **Recommendations** For versions prior to 3.1.5, update to version 3.1.5 or later to resolve the issue. As a temporary workaround, consider restricting the write access to the restapi.service file for the www-data user and limiting the Sudo privileges to prevent the execution of critical commands without a password.

**Name of the Vulnerable Software and Affected Versions** dmpop Mejiro versions prior to 3096393 **Description** The issue is a Reflected Cross-Site Scripting (XSS) vulnerability that allows attackers to run arbitrary code via a crafted string in the metadata of uploaded images. This can be exploited by attackers to execute malicious scripts. **Recommendations** For versions prior to 3096393, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting the upload of images or limiting access to the image upload feature until a patch is available. Avoid using the vulnerable image upload functionality until the issue is resolved.