Ilhomjon Rustamov

An authorization bypass exists in the media file download route. Unauthenticated attackers can access restricted files by submitting path-equivalent URL variants. By using normalized path forms, such as dot-slash prefixes, double slashes, or percent-encoded sequences, attackers can bypass role-based restriction checks. This occurs because the filesystem resolves the request to the protected file despite the security checks, allowing unauthorized file downloads without credentials.

The admin panel lacks per-request anti-CSRF tokens and relies exclusively on a Referer-header comparison within the `requestedByTheSameDomain()` function located in `data/inc/functions.admin.php` to protect `admin.php` actions. If a request is submitted without Referer or Host information, the system incorrectly treats it as a same-origin request. An attacker can bypass this check by suppressing the Referer header, allowing them to force an authenticated administrator to perform unauthorized actions. This can lead to stored Cross-Site Scripting (XSS) through the creation of pages containing raw HTML or Remote Code Execution (RCE) via the installation of malicious PHP modules and themes.

In the file `include/service/ai.php`, TLS certificate validation is disabled, allowing network-adjacent attackers to intercept outbound HTTPS requests to configured Large Language Model (LLM) providers by presenting arbitrary TLS certificates. This occurs because `CURLOPT SSL VERIFYPEER` and `CURLOPT SSL VERIFYHOST` are unconditionally disabled within the `sendStream()`, `sendImageRequest()`, `send()`, and `fetchSearchHtml()` functions. Attackers can execute a man-in-the-middle attack to extract Authorization Bearer API keys from AI requests and inject malicious AI responses. These responses may be processed by the tool-call execution pipeline, specifically affecting the `query database` and `update config` tool handlers.

A malicious obfuscated JavaScript payload is embedded in the Blade template used for rendering security OTP emails. This allows remote attackers to execute unauthorized code in browsers that render the email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, utilizes MutationObserver to install a password-field keylogger for capturing dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page.