Askar

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2.

Improper neutralization of script-related HTML tags allows for code injection. The issue stems from missing tokenization of user-supplied macro values before the `do shortcode()` function is executed, which allows submitted field values to be interpreted as shortcode syntax. Unauthenticated attackers can inject arbitrary shortcodes through form field values that are executed on the server when processed by the Send Email, Call Webhook, Redirect To Page, or Media field settings.

The plugin is susceptible to HTML injection and code injection due to improper neutralization of script-related HTML tags. This occurs because the `mep submit rsvp` AJAX action fails to perform post-type and member-only authorization checks and uses a generic, event-agnostic nonce `mep rsvp nonce` that can be obtained from public event pages. Consequently, unauthenticated attackers can inject arbitrary HTML content via the `attendee fields` POST data, which may then be rendered in the administration interface or confirmation output.

The issue allows Remote Command Execution as a Root user. This is achieved by injecting a malicious command inside the config file, which is then triggered by another part of the software.

The issue allows for Remote Command Execution via shell metacharacters in the `require/commandLine/CommandLine.php` file. This is due to the mishandling of the `mib file` in `plugins/main sections/ms config/ms snmp config.php`, specifically in the `get mib oid` function.

An issue was discovered in Open-AudIT where shell metacharacter injection is possible via attributes to an "open-audit/configuration/" URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings, internally referred to as `exclude ip`. This `exclude ip` value is passed to the `exec` function in the `discoveries helper.php` file, specifically inside the `all ip list` function, without being filtered. As a result, the attacker can provide a payload instead of a valid IP address.

The issue in Cacti's graph realtime.php file is related to the lack of neutralization of special elements, which can be exploited by a remote attacker to execute arbitrary code by sending a specially crafted request. This can be achieved via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

The issue allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the `ip src` parameter in an "index.php?operation/netflow/nf live view" request. This is due to a problem in the `netflow get stats` function in `functions netflow.php`.

An issue allows an attacker to directly execute system commands by sending a GET request to "search.crud.php" because the `catCommand` parameter is passed to the `exec` function without filtering, which can lead to command execution.

An issue allows an attacker to directly execute system commands by sending a GET request to "ajaxServerSettingsChk.php" because the `rootUname` parameter is passed to the `exec` function without filtering, which can lead to command execution.

The issue allows an attacker to execute arbitrary system commands. This is achieved by submitting a malicious command to the service edit.php file, which inserts the command into the database. The stored command can be triggered by calling the services.php file via a GET request with the service id followed by the parameter `a=start`.

The issue allows an attacker to execute arbitrary system commands. This is achieved by using the value `init script` in "Monitoring Engine Binary" in `main.get.php` to insert an arbitrary command into the database. The command is then executed by calling the vulnerable page "www/include/configuration/configGenerate/xml/generateFiles.php", which passes the inserted value to the database to `shell exec` without sanitizing it, thus allowing the execution of arbitrary system commands.

Name of the Vulnerable Software and Affected Versions: LibreNMS version 1.46 Description: The issue allows remote attackers to execute arbitrary OS commands. This is achieved by using the `community` parameter in the `html/pages/addhost.inc.php` page during the creation of a new device. Then, by making a request to the `/ajax output.php?id=capture&format=text&type=snmpwalk&hostname=localhost` endpoint, it triggers command mishandling in `html/includes/output/capture.inc.php`. Recommendations: For LibreNMS version 1.46, as a temporary workaround, consider restricting access to the `html/pages/addhost.inc.php` page and the `/ajax output.php` endpoint to minimize the risk of exploitation. Avoid using the `community` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.