Ka1N4T

**Name of the Vulnerable Software and Affected Versions** OpenCart versions 2.2.00 through 3.0.3.2 **Description** The issue allows a remote attacker to execute arbitrary code via the Fba plugin function in `upload/admin/index.php`. This is a SQL injection vulnerability. **Recommendations** For OpenCart versions 2.2.00 through 3.0.3.2, consider disabling the Fba plugin function in `upload/admin/index.php` as a temporary workaround until a patch is available. Restrict access to the `upload/admin/index.php` endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

### Impact A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247: An authenticated backend user with the `cms.manage pages`, `cms.manage layouts`, or `cms.manage partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. ### Patches Issue has been patched in Build 472 (v1.0.472) and v1.1.2. ### Workarounds Apply https://github.com/octobercms/october/commit/f63519ff1e8d375df30deba63156a2fc97aa9ee7 to your installation manually if unable to upgrade to Build 472 or v1.1.2. ### References Reported by [ka1n4t](https://github.com/ka1n4t) ### For more information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com) ### Threat assessment: <img width="1108" alt="Screen Shot 2020-10-10 at 1 21 13 PM" src="https://user-images.githubusercontent.com/7253840/95663316-7de28b80-0afb-11eb-999d-a6526cf78709.png">

**Name of the Vulnerable Software and Affected Versions** Joomla! versions 3.0.0 through 3.9.22 **Description** An issue was discovered that leads to a SQL injection vulnerability in the backend user list due to improper filter blacklist configuration. **Recommendations** For Joomla! versions 3.0.0 through 3.9.22, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** October CMS versions prior to 1.0.470 October CMS versions prior to 1.1.1 **Description** A bypass was discovered that allows an authenticated backend user with the `cms.manage pages`, `cms.manage layouts`, or `cms.manage partials` permissions to write specific Twig code and execute arbitrary PHP, despite `cms.enableSafeMode` being enabled. This issue affects users who rely on `cms.enableSafeMode` to restrict access to writing and executing arbitrary PHP in production. **Recommendations** For October CMS versions prior to 1.0.470, update to Build 470 (v1.0.470) or apply the patch from https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 manually. For October CMS versions prior to 1.1.1, update to v1.1.1 or apply the patch from https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 manually.

**Name of the Vulnerable Software and Affected Versions** October CMS versions 1.0.421 through 1.0.468 **Description** An attacker can exploit this issue to read local files on an October CMS server via a specially crafted request. The issue is exploitable by unauthenticated users. **Recommendations** For versions 1.0.421 through 1.0.468, update to Build 469 (v1.0.469) or v1.1.0 to resolve the issue. As a temporary workaround for versions that cannot be updated to Build 469, apply the patch from https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually.

**Name of the Vulnerable Software and Affected Versions** October CMS versions 1.0.319 through 1.0.468 **Description** The issue allows an authenticated backend user with the `cms.manage pages`, `cms.manage layouts`, or `cms.manage partials` permissions to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP, despite `cms.enableSafeMode` being enabled. This is a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write and execute arbitrary PHP. **Recommendations** For October CMS versions 1.0.319 through 1.0.468, update to Build 469 (v1.0.469) or v1.1.0 to resolve the issue. As a temporary workaround, consider applying the patch manually by using the comparison provided at https://github.com/octobercms/october/compare/106daa2930de4cebb18732732d47d4056f01dd5b...7cb148c1677373ac30ccfd3069d18098e403e1ca to your installation.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions prior to 3.9.14 **Description** The issue is caused by the lack of validation of configuration parameters used in SQL queries, resulting in various SQL injection vectors. **Recommendations** For versions prior to 3.9.14, update to version 3.9.14 or later to resolve the issue.