Chenhuanlin

A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** dbgate versions prior to 7.3.2 **Description** A path traversal flaw exists in the Create Connection Endpoint component. The issue occurs within the `zipJsonLinesData()` function located in the `packages/api/src/utility/zipJsonLinesData.js` file. By manipulating the `filePath` argument, a remote attacker can perform path traversal, which allows accessing files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** Update dbgate to version 7.3.2 or later. As a temporary workaround, restrict access to the Create Connection Endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** dbgate versions prior to 7.3.2 **Description** A path traversal issue exists in the Export Handler component within the `exportModelSql()` function of the `packages/api/src/controllers/databaseConnections.js` file. A remote attacker can manipulate the `outputFile` argument to perform path traversal, which allows accessing or writing to files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** Update dbgate to a version newer than 7.3.1. As a temporary mitigation, restrict access to the `exportModelSql()` function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** October CMS versions prior to 4.3.5 **Description** A server-side request forgery (SSRF) issue exists in the SSRF Protection component. The flaw is located within the `validateExternalImageHost()` function of the `System/Classes/ResizeImages.php` file, allowing a remote attacker to perform unauthorized requests from the server. **Recommendations** Update to version 4.3.5. As a temporary mitigation, restrict access to the `validateExternalImageHost()` function.

**Name of the Vulnerable Software and Affected Versions** dbgate versions prior to 7.3.2 **Description** A path traversal issue exists in the Archive Link Creation component. A remote attacker can manipulate the `linkedFolder` argument within the `createLink()` function located in the `packages/api/src/controllers/archive.js` file to access files or directories outside the intended folder. **Recommendations** Update dbgate to version 7.3.2 or later. As a temporary workaround, restrict access to the `createLink()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** dbgate versions 6.x through 6.8.1 dbgate versions 7.0.x through 7.0.2 dbgate versions 7.1.x through 7.1.8 dbgate versions 7.2.x through 7.2.5 dbgate versions 7.3.x through 7.3.1 **Description** A path traversal issue exists in the `save-uploaded-file` endpoint within the `files.js` file. This occurs when the `saveUploadedFile()` function improperly handles the `filePath` and `fileName` arguments, allowing a remote attacker to manipulate these variables to access or overwrite files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** As a temporary workaround, restrict access to the `save-uploaded-file` endpoint or avoid using the `filePath` and `fileName` arguments until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** zyx0814 FilePress versions prior to 3.0.2 **Description** A SQL injection issue exists in the Publish Module within the file `dzz/publish/search.php`. This flaw allows a remote attacker to execute unauthorized database queries by manipulating the `orderby` and `order` arguments. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `orderby` and `order` parameters in the `dzz/publish/search.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OctoberCMS versions prior to 4.1.20 OctoberCMS versions prior to 4.2.26 OctoberCMS versions prior to 4.3.5 **Description** A remote server-side request forgery exists due to the manipulation of the `realSourcePath` argument within the `getSourcePathForResize()` function of the `modules/system/classes/ResizeImages.php` file. Server-side request forgery is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Upgrade to version 4.3.5. Upgrade to version 4.4.0. As a temporary mitigation, restrict access to the `getSourcePathForResize()` function.