Bourbon Jean-Marie

An issue was discovered where the login page presents JavaScript functions to access a document on the server once successfully authenticated. However, an attacker can leverage the `downloadDocServer()` function to traverse the file system and access files or directories that are outside of the restricted directory. This is possible because `WealthT24/GetImage` is used with the `docDownloadPath` and `uploadLocation` parameters.

An issue in the secure portal of Publisure allows an authenticated administrator to inject arbitrary PHP code using the adminCons.php form. The injected code is stored in the E:PUBLISUREwebservicewebpagesAdminDirTemplates folder, and it remains even if removed from the adminCons.php view, potentially allowing the rogue PHP file to be hidden.

An issue in the servlet controller of the secure portal allows authentication bypass, enabling unauthorized queries on PHP forms within the /AdminDir folder, which should be restricted.

An issue in the secure portal of Publisure allows for SQL injections due to poorly sanitized SQL queries in the `userAccFunctions.php` file. This enables an attacker to access passwords and potentially grant access to the user account, escalating privileges to become an Administrator.

An issue allows an attacker to access the administration panel without authentication using `anonymous` access. Once logged in, a misconfiguration permits an anonymous user to deploy a malicious .war file, leading to remote code execution. The vendor notes that anonymous access is not available by default but remains optional for certain use cases, such as development environments.

An issue was discovered where an attacker can access the server without authentication in the case of a default installation without a security realm reference. This is because the configuration is effectively unsecured, as indicated by the Security Realms documentation in the product's Admin Guide. The vendor supports these unsecured configurations due to valid use cases during development.

The issue allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.