Haftoe

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 29.1 **Description** An unauthenticated SQL injection exists in the User Location plugin. The endpoints 'regions.json.php' and 'cities.json.php' fail to properly escape or bind the `country` and `region` GET parameters before using them in SQL queries. This allows attackers to perform UNION-based SQL injection, a technique used to combine the results of the original query with results from an injected query, to retrieve arbitrary database information such as password hashes and other sensitive data. **Recommendations** Update AVideo to a version later than 29.0. Restrict access to the 'regions.json.php' and 'cities.json.php' endpoints within the User Location plugin to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Grav versions 1.7.0 through 2.0.8 **Description** Authenticated users with create or update permissions on Flex-based directories, such as Flex Users, Flex Pages, Flex Objects, or custom Flex types, can execute arbitrary shell commands on the server. The issue occurs because the `FlexDirectory::dynamicDataField()` function resolves blueprint `data-*@:` directives by using `call user func array()` on input influenced by the user. While the system checks if the target is callable via `is callable()`, it fails to restrict dangerous functions like `exec`, `system`, `passthru`, or `shell exec`. This behavior bypasses previous validations implemented in `Blueprint::dynamicData()`. **Recommendations** Update Grav to version 2.0.9 or later.