Javokhir Tursunboyev

**Name of the Vulnerable Software and Affected Versions** toner-management (affected versions not specified) **Description** Admin state-changing handlers executed database operations including INSERT, UPDATE, and DELETE without authentication or authorization checks, although access control was present in listing views. This allows an unauthenticated remote attacker to directly invoke these handlers to create, modify, or destroy application data. The affected endpoints include 'add.php', 'edit.php', and 'delete.php' located under 'admin/toners', 'admin/toner-brands', 'admin/printers', and related admin subdirectories. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Inventory-Management-System-PHP (affected versions not specified) **Description** The software contains SQL injection flaws in two separate components. The 'login.php' endpoint constructs authentication queries using direct string concatenation of raw POST parameters `email` and `password`, which allows an attacker to bypass authentication. Additionally, the 'delete.php' endpoint executes queries using the `id` GET parameter without authentication checks or input validation, enabling unauthenticated attackers to delete arbitrary product records or perform blind SQL injection. Blind SQL injection is a technique used to extract information from a database by observing the time it takes for the server to respond to specific queries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 299Ko (affected versions not specified) **Description** An unauthenticated attacker can perform a reflected Cross-Site Scripting (XSS) attack via the public contact form. The issue occurs because the `home()` function in `plugin/contact/controllers/ContactController.php` assigns raw POST field values to the page template without sanitization. Subsequently, the ` show var()` function in `common/Template.php` echoes these values without using `htmlspecialchars()`, and the `contact.tpl` template outputs them unescaped into a textarea and an HTML attribute. This allows an attacker to execute malicious scripts in the browser of a visitor or administrator, potentially leading to session token theft. The vulnerable parameters are `name`, `firstname`, `email`, and `message`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Leantime version 3.6.2 **Description** An issue exists where the Laravel `VerifyCsrfToken` middleware is excluded from the global middleware stack in `app/Http/Kernel.php`. This allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by crafting malicious pages delivered via phishing emails or websites. This can trigger unauthorized POST, PUT, and DELETE requests to create or delete projects, modify settings, and change permissions. Cross-site request forgery is a type of attack that forces an authenticated user to execute unwanted actions on a web application. **Recommendations** Update Leantime to a version newer than 3.6.2.

**Name of the Vulnerable Software and Affected Versions** Leantime version 3.6.2 **Description** An open redirect issue exists in the Login controller. Unauthenticated attackers can redirect authenticated users to arbitrary external sites by manipulating the `redirectUrl` POST parameter. This is achieved by crafting a malicious login URL with a tampered `redirectUrl` value that bypasses the FILTER SANITIZE URL validation, potentially leading to phishing or credential theft. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Leantime version 3.6.2 **Description** An authenticated attacker can perform server-side request forgery (SSRF) and local file inclusion (LFI) by providing unsanitized filenames to the `file get contents()` function within the `Blueprints::import()` method. This occurs due to a lack of path validation. By sending crafted filenames containing path traversal sequences or URL wrappers through the JSON-RPC API endpoint, an attacker can read arbitrary files from the server filesystem or access cloud metadata services. **Recommendations** Update Leantime to a version newer than 3.6.2. As a temporary mitigation, restrict access to the JSON-RPC API endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Leantime versions prior to 3.6.3 **Description** Authenticated users can access milestone data from projects to which they are not assigned. This is possible by providing arbitrary integer milestone IDs to the 'tickets.getMilestone' JSON-RPC endpoint. An attacker can enumerate these IDs via the JSON-RPC API to retrieve project planning information, milestone titles, descriptions, and timelines across all projects on the instance, bypassing project membership restrictions. **Recommendations** Update Leantime to version 3.6.3 or later. As a temporary mitigation, restrict access to the 'tickets.getMilestone' JSON-RPC endpoint.