Benjamin Daniel Mussler

Name of the Vulnerable Software and Affected Versions: Vtiger CRM versions 6.3.0 and earlier Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to the `test/logo/` directory, and then accessing it via a direct request. This is due to an unrestricted file upload vulnerability in the `Settings Vtiger CompanyDetailsSave Action` class in `modules/Settings/Vtiger/actions/CompanyDetailsSave.php`. Recommendations: For versions 6.3.0 and earlier, consider restricting access to the `test/logo/` directory and disabling the file upload functionality in the `Settings Vtiger CompanyDetailsSave Action` class until a patch is available. As a temporary workaround, avoid using executable file extensions for uploads.

**Name of the Vulnerable Software and Affected Versions** Vtiger CRM version 6.4.0 **Description** The issue is related to an unrestricted file upload vulnerability in the Settings Vtiger CompanyDetailsSave Action class. This allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension and then accessing it via a direct request to the file. The vulnerability exists due to an incomplete fix for a previous issue. **Recommendations** For Vtiger CRM version 6.4.0, consider restricting access to the `CompanyDetailsSave.php` file in the `modules/Settings/Vtiger/actions/` directory to prevent exploitation until a proper fix is available. As a temporary workaround, avoid using the `CompanyDetailsSave Action` class until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open-Xchange OX Guard versions prior to 2.4.2-rev5 **Description** An issue in Open-Xchange OX Guard allows script code to be provided as a parameter to the OX Guard guest reader web application, enabling cross-site scripting attacks against arbitrary users without prior authentication. This can lead to malicious script code execution within a user's context, potentially resulting in session hijacking or triggering unwanted actions via the web interface, such as sending mail or deleting data, if the user has an active session on the same domain. **Recommendations** For Open-Xchange OX Guard versions prior to 2.4.2-rev5, update to version 2.4.2-rev5 or later to resolve the issue. As a temporary workaround, consider restricting access to the OX Guard guest reader web application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Open-Xchange OX Guard versions prior to 2.4.2-rev5 **Description** An issue in Open-Xchange OX Guard allows script code injected into a mail with an inline PGP signature to be executed when the signature is verified. This can lead to malicious script code execution within a user's context, potentially resulting in session hijacking or triggering unwanted actions via the web interface, such as sending mail or deleting data. **Recommendations** For versions prior to 2.4.2-rev5, update to version 2.4.2-rev5 or later to resolve the issue. As a temporary workaround, consider disabling the verification of inline PGP signatures until a patch is applied. Restrict access to sensitive features via the web interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Huawei E303 modems with software 22.157.18.00.858 Huawei Web UI version 11.010.06.01.858 **Description** A cross-site request forgery (CSRF) issue exists in the `api/sms/send-sms` endpoint of the Web UI, allowing remote attackers to hijack administrator authentication for requests that perform API operations and send SMS messages. This can be achieved via a request element in an XML document. **Recommendations** For Huawei E303 modems with software 22.157.18.00.858, consider restricting access to the `api/sms/send-sms` endpoint until a patch is available. For Huawei Web UI version 11.010.06.01.858, avoid using the Web UI for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.