Ana10Gy

Improper neutralization of special elements used in a template engine occurs within the SQL Preview Endpoint component. A remote attacker can manipulate the `sqlText` argument in the `execSqlText()` or `previewSqlText()` functions located in the `DesignerController.java` file to execute the attack.

A remote issue exists within the QueryerFactory component in the `DataSourceController.add()` function of the `DataSourceController.java` file. Manipulating the `queryerClass` argument can lead to permission issues.

A path traversal issue exists in the Common Download Endpoint within the `fileDownload()` and `resourceDownload()` functions of the `CommonController.java` file. A remote attacker can manipulate the `fileName` or `resource` arguments to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

An issue exists where performing a manipulation leads to deserialization, which is the process of converting a byte stream back into an object. This occurs within the `ObjectInputStream.readUnshared()` function located in the `src/main/java/com/scudata/parallel/SocketData.java` file, allowing for remote exploitation.

A remote SQL injection exists within the Move Operations component, specifically in the `ModuleController.java` file. The issue occurs when the `sourcePath` argument is manipulated, allowing an attacker to execute arbitrary SQL commands.

A path traversal issue exists in the 'addAccountHeadAndDetail' endpoint. This occurs within the `addAccountHeadAndDetail()` function located in the `jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java` file. A remote attacker can manipulate the `fileName` argument to access files and directories outside the intended folder. Path traversal is a technique that allows an attacker to read arbitrary files on the server by manipulating file paths.

A server-side request forgery (SSRF) exists in the platformConfig Add Endpoint. A remote attacker can manipulate the `platformValue` argument within the `insertPlatformConfig()` function of the `jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java` file to trigger the issue. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

A command injection issue exists within the Application Deployment Module in the `App.java` file. This occurs when the `uploadPath` argument is manipulated, allowing for remote exploitation.

A remote server-side request forgery (SSRF) exists in the Cloud Instance Metadata Endpoint component. The issue occurs within the `FileDownloadUtils.download2DiskFromNet()` function located in the `/airag/app/debug` file, where improper manipulation of processed URLs allows an attacker to induce the server to make unintended requests.

A server-side request forgery (SSRF) issue exists in an unknown function within the file `/airag/airagModel/test`. This occurs when the `baseUrl` argument is manipulated, allowing a remote attacker to induce the server to make unintended requests.

A server-side request forgery (SSRF) issue exists in the `WordUtil.addImage()` function within the `/airag/word/edit` file. This flaw allows a remote attacker to execute a manipulation that triggers the server to make unauthorized requests.

A server-side request forgery (SSRF) exists in the `updatePlatformConfigByKey` endpoint. This occurs when the `weixinUrl` argument is manipulated within the `getUserByWeixinCode()` function located in the `jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java` file. This flaw allows a remote attacker to induce the server to make unauthorized requests.

Improper authorization exists in the FillRuleUtil Component within the '/sys/fillRule/edit' endpoint. A remote attacker can manipulate the `ruleClass` argument to bypass authorization controls.

A server-side request forgery (SSRF) exists in the 'LoadFile' endpoint. The issue occurs within the `checkPathTraversalBatch()` function of the `FileDownloadUtils.jav` file due to improper manipulation of the `files` argument, allowing a remote attacker to initiate the attack.

An issue in the OpenApi Service component allows remote attackers to perform server-side request forgery (SSRF), a flaw where the server is coerced into making unintended requests. This occurs through the manipulation of the `originUrl` argument within the 'OpenApiController.add' and 'OpenApiController.call' functions of the `OpenApiController.java` file.

A flaw in the `uploadImgByHttpEndpoint` component allows for remote server-side request forgery (SSRF), which occurs when a server is tricked into making unauthorized requests to internal or external resources. This issue affects the functions `CommonController.uploadImgByHttp()`, `HttpFileToMultipartFileUtil.httpFileToMultipartFile()`, and `HttpFileToMultipartFileUtil.downloadImageData()` within the `CommonController.java` file.

An issue exists in the MdPreview component within the file 'ui/src/chat.ts'. This flaw allows a remote attacker to perform cross site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites.

Name of the Vulnerable Software and Affected Versions 1Panel-dev MaxKB versions up to 2.6.1 Description A vulnerability exists in the `execute` function within the file `apps/application/flow/step node/mcp node/impl/base mcp node.py` of the Model Context Protocol Node component. Manipulation of this function can lead to operating system command injection, potentially allowing remote attackers to execute arbitrary commands. The exploit has been publicly disclosed. Recommendations Upgrade the affected component to a fixed version.

Name of the Vulnerable Software and Affected Versions 1Panel-dev MaxKB versions up to 2.6.1 Description A flaw exists in the processing of the file `apps/common/middleware/chat headers middleware.py` within the ChatHeadersMiddleware component. Manipulation of the `Name` argument can lead to cross site scripting. Remote exploitation is possible. Recommendations Upgrade to version 2.8.0 to address this issue.

A cross-site scripting issue exists due to the manipulation of the `Name` argument within the `StaticHeadersMiddleware` function located in the `apps/common/middleware/static headers middleware.py` file of the Public Chat Interface component. The attack can be launched remotely.