Alejandro Ramos

An issue exists where the application constructs SQL queries using direct string interpolation via `str.format()` instead of parameterized queries. This allows the `docname` of a Supplier record containing SQL metacharacters to be interpreted as part of the query. An authenticated user with low privileges could exploit this to execute arbitrary SQL queries, bypass DocPerm access restrictions, and extract confidential data, including administrator password hash fragments, credentials, integration tokens, or financial information.

The issue allows a remote attacker to bypass authentication in the web interface of the affected systems, enabling them to retrieve the device configuration.

The issue concerns multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved through various parameters and variables, including the `file id` parameter to "attachment send.php", the `$addy`, `$address`, and `$a address` variables in "email parser.php" and "structs.php" respectively, the `kbid` parameter to "cer KnowledgebaseHandler.class.php", the `queues[]` parameter to "addresses export.php", the `$thread` variable to "display.php", and the `ticket` parameter to "display ticket thread.php".

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `kb ask` parameter in the "index.php" file.