Liotree

An authentication bypass exists that allows unauthenticated attackers to gain super-administrator access. This is achieved by injecting query conditions into the `JPOM-USER-TOKEN` header. Specifically, providing a value such as 'is not null' is misinterpreted as an operator by Hutool's Condition parser, enabling the attacker to bypass login and execute server commands via script features.

Cacti provides an operational monitoring and fault management framework. A SQL injection vulnerability in the `automation get new graphs sql` function of `api automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api automation.php` line 856, the `get request var('filter')` is being concatenated into the SQL statement without any sanitization. In `api automation.php` line 717, the filter of `'filter'` is `FILTER DEFAULT`, which means there is no filter for it.

Name of the Vulnerable Software and Affected Versions: Cacti versions 1.3.x Description: A reflected cross-site scripting issue in Cacti allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This is related to the lack of measures to neutralize special elements in the display settings function, which can be exploited by a remote attacker to perform cross-site scripting using cookie forgery. Recommendations: For versions 1.3.x, update to a version that includes the fix for this issue, specifically the commit a38b9046e9772612fda847b46308f9391a49891e. As a temporary workaround, consider restricting access to the display settings function to minimize the risk of exploitation.

An issue in Ecommerce-CodeIgniter-Bootstrap allows a remote attacker to execute arbitrary code via the `saveLanguageFiles` method of the `Languages.php` component. This issue can lead to privilege escalation. It is recommended to review the code for validation gaps and limit file write destinations to prevent remote attacks.

The issue allows a remote attacker to execute arbitrary code via the `removeSecondaryImage` method of the `Publish.php` component. This enables the attacker to perform unauthorized actions on the system.

A SQL injection issue allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component.

An issue in hisiphp allows a remote attacker to execute arbitrary code via a crafted script to the `SystemPlugins::mkInfo` parameter in the SystemPlugins.php component.

An issue in the software allows a remote attacker to execute arbitrary code via a crafted script to the `AddonsController.class.php` component.

The issue allows a remote attacker to execute arbitrary code via the `getLangFolderForEdit` method of the `Languages.php` component.

The issue allows a remote attacker to execute arbitrary code via the `manageQuantitiesAndProcurement` method of the `Orders model.php` component. This is a SQL Injection vulnerability.

The issue allows remote attackers to execute arbitrary code and obtain sensitive information via modules/gleez/classes/request.php. This is a Server Side Request Forgery (SSRF) vulnerability.

A command injection vulnerability allows any unauthenticated user to execute arbitrary commands on the server when the `register argc argv` option of PHP is `On`. The vulnerability is located in `cmd realtime.php` and is exploited through the `$poller id` variable, which can be controlled by URL when `register argc argv` is `On`. This option is `On` by default in many environments.

The issue allows a remote attacker to escalate privileges via the ChannelModel::updateapk method of the channelmodle.php. This is a SQL Injection vulnerability.