Huajihd

A technician can delete arbitrary files from the filesystem, provided the webserver has write permissions for those files.

An authenticated user with config READ permission can read a specific asset object.

A technician can read arbitrary files located within the `GLPI DOC DIR` directory.

An issue exists where the endpoint `modules/Forum/pages/forum/get quotes.php` only verifies if a user is logged in before retrieving a post based on the `post` variable. The backend helper in `modules/Forum/classes/Forum.php` fails to enforce Access Control Lists (ACLs)—which are sets of rules that define permissions for users or systems—for forums or topics. This allows authenticated users with low privileges to enumerate post IDs and access content from private, hidden, or staff-only forums, bypassing the visibility restrictions enforced in `modules/Forum/pages/forum/view topic.php`.

In the `modules/Forum/classes/ForumPostReactionContext.php` file, the software verifies if a caller can view the forum but fails to enforce the topic-level `view other topics` authorization. This allows users who are restricted to viewing only their own topics to read and modify reactions on topics belonging to other users.

The profile page located at 'modules/Core/pages/profile.php' processes wall post submissions and replies before verifying if the viewer is authorized to access the profile. This allows users with the `profile.post` permission to write wall posts to profiles that are private or have blocked them. Furthermore, the reply mechanism fails to verify that the target wall post belongs to the current profile, which enables attackers to inject replies into wall posts owned by other profiles using a restricted profile URL.

NamelessMC is website software for Minecraft servers. The software fails to enforce blocked or private profile visibility in `core/classes/Misc/ProfilePostReactionContext.php`, verifying only that the wall post exists. Additionally, the endpoint "modules/Core/queries/reactions.php" allows unauthenticated GET requests for reaction details. This allows unauthenticated visitors to read reaction participants and timestamps for private profile posts, and enables authenticated low-privileged users to add reactions to private or blocking profile posts.

NamelessMC is website software for Minecraft servers. In the file `core/classes/Misc/ProfilePostReactionContext.php`, the system only verifies the existence of a wall post without enforcing visibility restrictions for blocked or private profiles. This allows authenticated low-privileged users to add reactions to posts on profiles that have blocked them or are set to private.

Missing authorization in the system API endpoint allows authenticated users to access sensitive information. Specifically, the '/api/system' endpoint leaks the installed Kirby version and the status, type, and code of the installed license to users who lack the `access.system` permission. This information can be utilized by malicious actors during reconnaissance to plan further attacks.

Missing authorization allows authenticated Panel users to access site, user, and role information without proper permission gating. This occurs because permission settings for the site model, users, and user roles were not implemented, meaning that even if a developer disabled all permissions using the `"*": false` setting, these specific actions remained accessible. The affected areas include the ability to list and access the site model, as well as viewing user and role details, including names, descriptions, and configured permissions. Specifically, the missing permissions were `site.access`, `user.access`, `users.access`, `user.list`, and `users.list`.

The backend upgrade interface allows the submission of remote SQL and ZIP URLs through GET parameters. The server downloads and executes the SQL file and extracts the ZIP file directly into the web root directory without validating a CSRF (Cross-Site Request Forgery) token—a mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts. This allows an attacker to trick an authenticated administrator into visiting a malicious link, resulting in arbitrary SQL execution and arbitrary file write.

Saloon is a PHP library used for building API integrations and SDKs. Prior to version 4.0.0, the library lacked validation when constructing file paths from fixture names. This allowed names containing path segments, such as `../traversal` or `../../etc/passwd`, to create paths outside the intended fixture directory. Consequently, reading or writing fixtures could lead to unauthorized file access or modification anywhere the process had permissions. If the fixture name originated from user-controlled input, such as request parameters or configuration settings, this constituted a path traversal issue. The fix implemented in version 4.0.0 introduces validation in the fixture layer, rejecting names with characters like `/`, ``, `..`, or null bytes, and restricting the character set to safe options. Additionally, a defense-in-depth mechanism was added to the storage layer to ensure resolved paths remain within the base directory before any read or write operation.

Saloon is a PHP library used for building API integrations and SDKs. A flaw exists where the library combines a connector's base URL with a request endpoint. If the endpoint is a valid absolute URL, Saloon uses that URL directly, bypassing the base URL and any associated authentication mechanisms. This allows attackers to potentially perform server-side request forgery (SSRF) and leak credentials to a host they control if the endpoint is influenced by user input or configuration parameters like redirect uri or callback URL. The `URLHelper::join()` function does not validate the endpoint, leading to this behavior.

A weakness exists in MacCMS that allows authorization bypass. This issue affects the `order info` function within the `application/index/controller/User.php` file, specifically within the Member Order Detail Interface. Manipulation of the `order id` argument can lead to unauthorized access. The exploit for this issue has been publicly released and could be used for remote attacks.

A security flaw exists in MacCMS that allows for missing authentication. The issue is located in the file `application/api/controller/Timming.php` within the Timming API Endpoint component. The attack can be performed remotely. The exploit has been publicly released.

The `DomainFilteringAdapter` within the Embed extension is susceptible to an allowlist bypass because of a missing hostname boundary assertion in the domain-matching regular expression. A malicious domain, such as `youtube.com.evil`, can pass the allowlist check when `youtube.com` is a permitted domain. This allows for two potential attack vectors: Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS). The `OscaroteroEmbedAdapter` makes server-side HTTP requests to the embed URL, and a bypassed domain filter could lead to requests to attacker-controlled hosts. The `EmbedRenderer` outputs the oEmbed response HTML directly into the page without sanitization, allowing an attacker controlling the bypassed domain to return arbitrary HTML/JavaScript.