Adam Młynarczyk

Authenticated administrators can achieve arbitrary code execution by submitting a serialized PHP object as a settings value. This occurs because the value is stored without sanitization and subsequently processed by the `getValueAttribute()` function. An attacker can use the admin settings form, such as the `maintenance message` setting loaded by `CheckMaintenance.php`, to submit a serialized gadget chain. This allows the execution of arbitrary operating-system commands as the PHP application process user, and the effect remains until the value is overwritten.

An issue exists in the `ThemeModule::startImport()` function where uploaded ZIP archives are extracted directly into the public web root without validation of file names, extensions, or content. An authenticated administrator can exploit this by uploading a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, allowing the execution of arbitrary OS commands as the web-server user via the themes directory.

Authenticated administrators can execute arbitrary operating system commands as the web server user by abusing the Import/Export functionality. This feature, designed for data portability, can be leveraged to deploy and execute malicious code on the application server host.

A cross-site scripting issue exists in the contacts module. Remote attackers can execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. This occurs because the sanitization logic only removes the first occurrence of each angle bracket character, leaving subsequent brackets intact. An attacker can exploit this by sending a crafted email that executes scripts in the victim's browser when the user opens the message and uses the Add Local Contacts function.

Authenticated attackers can execute arbitrary operating system commands via a PHP object injection. This occurs when a crafted PHP object graph is supplied through the `back query` GET parameter of the logout handler. The application decodes a base64-encoded serialized payload and passes it to the `unserialize()` function without an allow-list, signature check, or type restriction, allowing for gadget-chain exploitation to achieve remote code execution as the web server process.

Authenticated attackers with event creation or edit permissions can perform cross-site scripting by embedding a malicious event title containing the `</script>` sequence. This occurs because the sequence is not escaped by `JSON.stringify()` when embedded in inline script tags. This allows the attacker to break out of the script context within the `application/ld+json` structured data block or server-side rehydrated state, executing arbitrary HTML and JavaScript in the browser of any user viewing the public event page, including unauthenticated visitors and administrators.

Missing server-side visibility enforcement allows unauthenticated attackers to purchase hidden tickets. By referencing hidden product and price IDs in order creation requests, attackers can bypass authorization checks. This is possible by enumerating sequential hidden ticket IDs based on visible ones to acquire VIP, invite-only, or discounted tickets that were intentionally withheld from public sale.