Jiva

**Name of the Vulnerable Software and Affected Versions** Krayin CRM versions prior to 2.2.4 **Description** Authenticated users with leads access can perform a blind SQL injection in the leads DataGrid. The issue occurs when the `rotten lead[in]` query parameter is concatenated without parameterized binding directly into a `havingRaw()` function call within LeadDataGrid.php. This allows attackers to use time-based and boolean-based blind injection techniques to extract sensitive information from the database, such as user credential hashes, CRM records, and application configuration data. **Recommendations** Update Krayin CRM to version 2.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.2.1 **Description** A stored cross-site scripting issue exists in the patient portal template system. Authenticated administrators can inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, as the system only filters literal PHP open tags. The lack of output encoding at the template retrieval endpoint, combined with missing HttpOnly cookie attributes, allows the exfiltration of session tokens via `document.cookie` access. This can lead to full session hijacking of any administrator, clinician, or portal patient who views a poisoned template. **Recommendations** Update to version 8.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.2.1 **Description** An authentication bypass exists that allows users with valid credentials to circumvent multi-factor authentication. This is achieved by exploiting the OAuth2 password grant flow via an unauthenticated client registration endpoint. An attacker can register an OAuth2 client through this endpoint and use the password grant to exchange credentials for an API access token, thereby bypassing the standard web interface authentication and enforced multi-factor authentication controls. **Recommendations** Update to a version newer than 8.2.0.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.2.1 **Description** An authenticated SQL injection exists in the backup configuration import feature. Administrators with admin or super ACL privileges can execute arbitrary Data Definition Language (DDL) and Data Manipulation Language (DML) statements against the application database. This is achieved by uploading a crafted SQL file via the `form step=202` parameter in the 'backup.php' endpoint. The issue stems from an unfiltered `shell exec()` invocation of the mysql command-line client, which can be used to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem if MySQL FILE privileges and permissive `secure file priv` settings are configured. **Recommendations** Update to version 8.2.1 or later. Restrict access to the 'backup.php' endpoint to only the most trusted administrators. Configure the `secure file priv` setting in MySQL to a restrictive value to prevent arbitrary file writes.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.2.1 **Description** A remote code execution issue exists in the document category tree component located in `library/classes/Tree.class.php`. Authenticated administrators can execute arbitrary operating system commands by injecting PHP payloads into the categories database table. This is achieved by chaining arbitrary SQL execution to change the `id` column type to VARCHAR and inserting a malicious payload. The payload is subsequently executed via an unsanitized `eval()` function whenever any page instantiates `CategoryTree`, which includes pages accessible to unauthenticated or low-privilege users, leading to command execution with the privileges of the web server user. **Recommendations** Update to version 8.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Krayin CRM version 2.2.4 **Description** Missing authentication in the installer middleware allows unauthenticated remote attackers to overwrite the primary administrator account. By sending a crafted HTTP POST request containing the `X-Requested-With: XMLHttpRequest` header, an attacker can bypass the CanInstall middleware redirect check. This allows the submission of arbitrary name, email, and password values to the 'admin-config-setup' endpoint, which executes an unauthenticated `updateOrInsert()` function targeting the hardcoded administrator user ID, granting full administrative access to all CRM data. **Recommendations** Update Krayin CRM to a version newer than 2.2.4.

**Name of the Vulnerable Software and Affected Versions** FrontAccounting versions prior to 2.4.20 **Description** A path traversal issue exists in the attachment upload handler. Authenticated attackers can execute arbitrary code by uploading files using traversal sequences in the `unique name` parameter. By providing sequences such as ../../../shell.php, an attacker can write files outside the designated attachments directory and into the web root. Since the system lacks extension validation for uploaded PHP files, this allows for remote code execution as the web server user. **Recommendations** Update to version 2.4.20 or later.

**Name of the Vulnerable Software and Affected Versions** FrontAccounting versions prior to 2.4.20 **Description** An issue exists in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data. By injecting UNION SELECT payloads into the `PARAM 0` POST parameter, attackers can use malicious SQL syntax through an unparameterized WHERE clause to retrieve sensitive information, such as usernames, password hashes, and email addresses from the users table, which is then rendered in the PDF report output. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to database data. **Recommendations** Update FrontAccounting to version 2.4.20 or later.

**Name of the Vulnerable Software and Affected Versions** FrontAccounting versions prior to 2.4.20 **Description** An issue exists in the Audit Trail report handler that allows authenticated attackers with SA GLANALYTIC permission to execute arbitrary SQL queries. This is achieved by injecting malicious code into the `PARAM 2` and `PARAM 3` POST parameters. Exploitation can occur via time-based blind SQL injection using `SLEEP()` functions, which can be amplified across JOIN result sets to cause a denial of service by exhausting database connections. Additionally, attackers may use UNION-based injection techniques to extract arbitrary database content. **Recommendations** Update to version 2.4.20 or later.

**Name of the Vulnerable Software and Affected Versions** FrontAccounting versions prior to 2.4.20 **Description** An issue exists in the `get gl transactions()` function where the `filter type` parameter is concatenated directly into a SQL IN() clause without parameterization. This allows users with SA GLANALYTIC permissions to perform boolean-based blind SQL injection—a technique used to extract data by observing differences in server responses to true or false queries—by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data. **Recommendations** Update FrontAccounting to version 2.4.20 or later. As a temporary workaround, restrict the SA GLANALYTIC permission to trusted users only.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.2.0 **Description** An improper authentication issue exists in the OAuth2 dynamic client registration endpoint. Unauthenticated attackers can register a malicious client with system-level FHIR (Fast Healthcare Interoperability Resources, a standard for exchanging electronic health records) scopes by providing a self-generated RSA keypair through the `jwks` field. After an administrator approves the client, the attacker can use the `client credentials` grant with a self-signed JWT (JSON Web Token) assertion to obtain access tokens, granting read access to all FHIR resources for all patients in the system. **Recommendations** Update OpenEMR to version 8.2.0 or later. Restrict access to the OAuth2 dynamic client registration endpoint to prevent unauthorized client registrations.

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP/CRM versions prior to 23.0.2 **Description** An authenticated remote code execution issue exists in the `dol eval standard()` function. The system fails to apply forbidden string checks when operating in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via `eval()`. The root cause is that the `$forbiddenphpstrings` blocklist is only enforced in blacklist mode, while the whitelist regex is blind to PHP dynamic callable syntax. **Recommendations** Update to version 23.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** EspoCRM versions prior to 9.3.4 **Description** The EspoCRM software contains a flaw due to the formula engine operating outside the field-level restriction layer, allowing writable access to fields marked as read-only, such as `Attachment.sourceId`. This allows modification of the `sourceId` via a formula, leading to a path traversal issue when the `getFilePath()` function is used without proper sanitization. An attacker can upload a webshell using chunked upload, poison the `.htaccess` file, and achieve Remote Code Execution (RCE) as the `www-data` user. Exploitation requires admin credentials and six requests. The vulnerable component is the formula engine and the `getFilePath()` function. The `sourceId` variable is directly concatenated into a file path without sanitization. **Recommendations** Update to EspoCRM version 9.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** Vtiger CRM versions prior to 8.4.1 **Description** An authenticated remote code execution issue exists in the admin module import feature. Administrator-level attackers can upload arbitrary PHP files by submitting a crafted zip archive through the `ModuleManager` import function. The system extracts contents directly into the `modules/` directory under the web root without validating file types beyond the `manifest.xml` descriptor. This allows attackers to place executable PHP files in the `modules/` directory that are directly accessible via HTTP, bypassing the authentication and authorization layer because the web server resolves the path and invokes the PHP interpreter before the application routing layer is involved, creating a persistent web shell. **Recommendations** Update Vtiger CRM to a version newer than 8.4.0. Restrict access to the `ModuleManager` import function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Vtiger CRM versions prior to 8.4.0 **Description** An authenticated file upload issue exists in the Documents module that allows low-privileged users to achieve remote code execution. This occurs because the extension denylist in `config.inc.php` omits the `.phar` extension, enabling the upload of files containing arbitrary PHP code. These files are stored with their original extension in a web-accessible directory. Furthermore, on Apache 2.4 deployments, a misconfigured `.htaccess` file using Apache 2.2 syntax is ignored, which allows unauthenticated HTTP requests to execute the uploaded PHP payload. **Recommendations** Update Vtiger CRM to version 8.4.0 or later.