Joshuaalwin

The database import Livewire component `app/Livewire/Project/Database/Import.php` allows an authenticated user to inject shell commands. This occurs because client-controlled container and server properties are passed to shell commands without proper locking or validation, specifically through the database import container name.

An authenticated command injection exists in the GetLogs Livewire component. Users with team membership, including those with the lowest privilege role, can execute arbitrary commands as root on managed servers. This occurs because the `$container` Livewire public property is interpolated directly into shell commands, such as `docker logs` and `docker service logs`, without proper sanitization. Furthermore, the property lacks the `#[Locked]` attribute, allowing it to be modified by any client via the Livewire wire protocol.

Manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, can lead to the loss of content, assets, and user accounts. Exploitation via the Control Panel requires authentication with minimal permissions, such as the "view entries" permission to delete entries or the "view users" permission to delete users. Exploits targeting the REST and GraphQL APIs do not require permissions, but these APIs are not enabled by default; they must be explicitly enabled without authentication and with specific resources accessible to be exploited.