Darren Mcdonald

An issue exists where attackers with physical access can execute arbitrary Linux loader parameters. This is possible by writing to an unencrypted and unsigned configuration area that is read by the signed bootloader. This allows the injection of malicious kernel command line parameters that execute with boot environment privileges. Because the attack does not modify the measured boot code, it does not trigger TPM PCR measurement failures. TPM PCR (Trusted Platform Module Platform Configuration Register) measurements are used to ensure the integrity of the boot process.

A secure boot bypass exists in the GRUB boot stage. A physically present attacker can gain unauthorized root access by placing an unsigned empty file named `igel.conf` on a partition. This exploits a fail-open signature verification behavior in GRUB, allowing the attacker to access an interactive GRUB prompt and boot the device kernel with additional command-line arguments. This process results in a root shell with the disk unlocked while TPM PCR (Platform Configuration Registers) values remain unaltered.

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various fields, including the Additional Information field to "challenge.php", the Additional Information or Contact information field to "joinus.php", the War Report field to "admin/admin.php" in a finishwar action, or the Nick field to "profile.php".

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `ratearticleselect` parameter in the "article.php" file.

The issue allows remote attackers to bypass intended member restrictions and read news posts. This is achieved by modifying the `newsid` parameter in a "printnews" action.

The issue concerns the `createRandomPassword` function, which uses a limited range of values for the seed argument in the PHP `mt srand` function. This limitation makes it easier for remote attackers to determine randomly generated passwords through a brute-force attack.

The issue allows remote attackers to bypass timeout and logout actions, retaining access for a long period. This is possible because the software uses static session cookies that depend only on a user's password. By leveraging knowledge of a session cookie, attackers can exploit this.

The issue allows remote attackers to cause a denial of service, specifically memory consumption, by providing a large integer in the `ratearticleselect` parameter. This is related to the "article.php" component.

The issue allows remote authenticated users to trigger crafted SMTP traffic via specific characters in an org name or e-mail address, related to a "2nd Order SMTP Injection" issue. This can be achieved by including (1) double quote and newline characters in an org name or (2) double quote characters in an e-mail address.

The issue allows remote authenticated users to cause a denial of service or spoof votes and comments by selecting a conflicting e-mail address, as the software does not require unique e-mail addresses for user accounts.

The issue makes it easier for remote attackers to obtain access by leveraging an unattended workstation, as the authentication fields lack an off autocomplete attribute.

The password reset feature generates different error messages for failed reset attempts depending on whether the e-mail address is registered. This allows remote attackers to enumerate user accounts via a series of requests.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the `return to` parameter. Additionally, remote authenticated users can redirect users to arbitrary web sites and conduct phishing attacks via crafted characters in the domain name of a subdomain.

The issue allows remote attackers to inject arbitrary web script or HTML via the description field of a new vote or the eject member proposal feature, potentially leading to cross-site scripting (XSS) attacks.