Iltosec

A server-side request forgery (SSRF) issue exists in the webhook testing feature. This allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges (private IP address spaces). By pointing webhooks at internal hosts and ports and comparing 4xx versus 5xx responses from the Test Webhooks functionality, an attacker can map active hosts and open ports.

An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint via the `frequency` parameter. Although the `recurring invoice frequency` is processed by `sanitizeInput()`, it is interpolated unquoted into a DATE ADD function, allowing SQL syntax to escape the interval expression. This enables an attacker to assign additional INSERT columns and store subquery results in `recurring invoice note`, which are then exposed through the 'agent/recurring invoice.php' endpoint. Additionally, the stored `recurring invoice frequency` can trigger a second-order injection when used in a subsequent UPDATE operation by another user. This can lead to the exposure of password hashes, SMTP credentials, user records, and database metadata, as well as the modification of database fields and potential administrative takeover.

A user possessing `users.edit` and API permissions can escalate their privileges by sending a PATCH request to the '/api/v1/users/{their own id}' endpoint. This allows the user to grant themselves various permissions, such as `assets.view`, `assets.create`, `reports.view`, and import capabilities, although they cannot grant themselves admin or superuser status.

An authenticated user with `module support` write permission and access to a credential record can perform time-based blind SQL injection. This occurs because the `expires` parameter of the `share generate link` handler in the `agent/ajax.php` endpoint is inserted unquoted into the `item expire at` MySQL INTERVAL expression. Although `sanitizeInput()` applies string-context escaping, the lack of quoting allows a crafted expression and interval unit to execute conditional database queries, with results inferred from response delays. This can lead to the exposure of password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata, potentially enabling administrative takeover after credential cracking.