Jmrcsnchz

Caddy is an extensible server platform that uses TLS by default. The `stripHTML` template function, specifically within the `funcStripHTML()` function, cannot reliably remove all HTML tags from input strings. Certain malformed HTML can bypass the tag-stripping logic, potentially leaving dangerous content in the output. If this output is later rendered as HTML, it may allow client-side Cross-Site Scripting (XSS), where an attacker can execute arbitrary JavaScript in the user's browser.

The issue is related to insufficient input validation, which leads to cross-site scripting (XSS) in almost all input fields of the facileManager web application.

The issue concerns a modular suite of web apps built with the sysadmin in mind. In the affected versions, the `$ REQUEST` global array was unsafely called inside an `extract()` function in `admin-logs.php`. Although the PHP file `fm-init.php` prevents arbitrary manipulation of `$ SESSION` via the GET/POST parameters, it does not prevent manipulation of other sensitive variables such as `$search sql`. An authenticated user with privileges to view site logs can manipulate the `$search sql` variable by appending a GET parameter `search sql` in the URL. This renders the checks and SQL injection prevention attempts unusable.

The issue allows non-admin users to arbitrarily set their permissions and grant their non-admin accounts with super user privileges when updating their profile. This is done through a POST request containing user information sent to the endpoint "server/fm-modules/facileManager/ajax/processPost.php".

A command injection issue exists in WWBN AVideo, allowing Remote Code Execution when the CloneSite Plugin is used. This issue is related to the `plugin/CloneSite/cloneClient.json.php` endpoint. It is a bypass to a previous fix and is patched in a specific commit.

An OS Command Injection issue in the authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. The vulnerable code executes a command that includes user-controlled input, specifically the `cloneSiteURL` variable, which can be manipulated through the admin panel's clone site feature. By hosting a specially crafted `cloneServer.json.php` file, an attacker can inject malicious commands, leading to remote code execution. This issue is exploited by sending a GET request to the vulnerable endpoint.