Daniel Jones

The issue arises from the wg7.php file in Webgalamb, which makes opportunistic calls to `htmlspecialchars()` instead of utilizing a templating engine with proper contextual encoding. This allows for the insertion of arbitrary strings into the database, enabling any JavaScript to be executed by the administrator, resulting in a cross-site scripting (XSS) issue.

The issue allows for SQL injection via the `Client-IP` HTTP request header in the subscriber.php file.

The issue concerns a lack of security measures to prevent CSRF attacks. This can be demonstrated through the API endpoint "wg7.php?options=1" which allows changing the administrator password.

A directory traversal vulnerability in system/ajax.php could lead to arbitrary code execution by authenticated administrator users, because PHP files are restored under the document root directory. The issue is related to the "wgmfile restore" functionality.

The issue concerns the exposure of log files to the internet, potentially containing sensitive client data such as email addresses. This exposure also facilitates the exploitation of SQL injection errors. The log files are stored with predictable filenames, making them easily accessible.

The issue allows for arbitrary code execution, which can be exploited remotely without initial authentication. To exploit this, an attacker must bypass authentication to access administrative site functions, then upload a crafted CSV file containing a malicious payload. This payload becomes part of a PHP eval() expression in the subscriber.php file.

The system/ajax.php functionality in Webgalamb is supposed to be restricted to administrators. However, unauthenticated users can access most of these methods by utilizing certain query parameters, specifically `bgsend`, `atment sddd1xGz`, or `xls bgimport`.