Benjamin Mossé

**Name of the Vulnerable Software and Affected Versions** Koan Software Mega Mall (affected versions not specified) **Description** The issue allows remote attackers to obtain the installation path via a request with an empty value of the `x[]` parameter in the product review.php file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Koan Software Mega Mall (affected versions not specified) **Description** The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved by manipulating specific parameters in certain PHP files. The vulnerable parameters include `t`, `productId`, `sk`, `x`, and `so` in the "product review.php" file, and the `orderNo` parameter in the "order-track.php" file. **Recommendations** For Koan Software Mega Mall, consider temporarily restricting access to the "product review.php" and "order-track.php" files until a patch is available. Avoid using the parameters `t`, `productId`, `sk`, `x`, `so`, and `orderNo` in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: PhpMyAdmin versions prior to 2.9.1.1 Description: The issue allows remote attackers to obtain the full server path. This can be achieved through direct requests to certain scripts, such as scripts/check lang.php and themes/darkblue orange/layout.inc.php. Additionally, the issue can be exploited via specific array arguments to index.php, including `lang[]`, `target[]`, `db[]`, `goto[]`, `table[]`, and `tbl group[]`. Other vulnerable parameters include the `back[]` argument to sql.php, an invalid `sort by` parameter to server databases.php, and the `db` parameter to db printview.php. Recommendations: For versions prior to 2.9.1.1, update to version 2.9.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable scripts and parameters, such as scripts/check lang.php, themes/darkblue orange/layout.inc.php, and the specified array arguments to index.php, until a patch is applied. Avoid using the vulnerable parameters, including `lang[]`, `target[]`, `db[]`, `goto[]`, `table[]`, `tbl group[]`, `back[]`, `sort by`, and `db`, in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** CandyPress Store version 3.5.2.14 **Description** The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the `policy` parameter in "openPolicy.asp" or the `brand` parameter in "prodList.asp". **Recommendations** For CandyPress Store version 3.5.2.14, consider restricting access to the vulnerable API endpoints "openPolicy.asp" and "prodList.asp" to minimize the risk of exploitation. Avoid using the `policy` and `brand` parameters in these endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** BlogMe version 3.0 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the comments.asp file. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `Name`, `URL`, or `Comments` field. **Recommendations** For BlogMe version 3.0, consider disabling the comments.asp file or restricting input to the `Name`, `URL`, and `Comments` fields until a patch is available. Avoid using these fields in the affected comments.asp file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** BlogMe version 3.0 **Description** The issue concerns SQL injection vulnerabilities in the admin login.asp file. Remote attackers can execute arbitrary SQL commands by manipulating the `Username` or `Password` fields. **Recommendations** For BlogMe version 3.0, consider restricting access to the admin login.asp file until a patch is available. As a temporary workaround, avoid using the `Username` and `Password` fields in the admin login.asp file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hpecs Shopping Cart (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `username` and `password` fields in the login screen, as well as the `searchstring` parameter in the "insearch list.asp" endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Abarcar Realty Portal (affected versions not specified) Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `neid` parameter to "newsdetails.php" or the `slid` parameter to "slistl.php". However, it's noted that "slistl.php/slid" never existed in any version of the software. The vendor has also stated that the current version only creates static pages. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeWebshop versions 2.2.2 and earlier **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `cat` parameter in the "index.php" file. **Recommendations** For FreeWebshop versions 2.2.2 and earlier, update to a version later than 2.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the `cat` parameter in the "index.php" file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FreeWebshop versions 2.2.2 and earlier **Description** A directory traversal issue exists, allowing remote attackers to read and include arbitrary files. This is achieved by using a .. (dot dot) in the `page` parameter of the index.php file. **Recommendations** For FreeWebshop versions 2.2.2 and earlier, consider restricting access to the index.php file until a fix is available. As a temporary workaround, avoid using the `page` parameter in the index.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Speedywiki version 2.0 **Description** The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is achieved by setting the `upload` parameter to 1 in the index.php file. **Recommendations** For Speedywiki version 2.0, consider restricting access to the index.php file to prevent unauthorized uploads until a patch is available. As a temporary workaround, disable the file upload functionality in index.php to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Speedywiki version 2.0 **Description** The issue allows remote attackers to obtain the full path of the web server. This can be achieved via the `showRevisions[]` and `searchText[]` parameters in "index.php", and also through a direct request to "upload.php" without any parameters. **Recommendations** For Speedywiki version 2.0, consider restricting access to the `showRevisions[]` and `searchText[]` parameters in "index.php" and limit direct requests to "upload.php" to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Speedywiki version 2.0 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `showRevisions` parameter in the "index.php" file. **Recommendations** For Speedywiki version 2.0, consider restricting access to the `showRevisions` parameter in the "index.php" file until a patch is available. As a temporary workaround, avoid using the `showRevisions` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.