Luca Cetro

A SQL injection issue exists in the Search functionality of the tickets.php page, allowing authenticated attackers to execute arbitrary SQL commands. This is achieved via a combination of the `keywords` and `topic id` URL parameters.

Name of the Vulnerable Software and Affected Versions: Zucchetti Ad Hoc Infinity version 2.4 Description: A local file include issue in the `/servlet/Report` allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through `/jsp/zimg upload.jsp`. Recommendations: For Zucchetti Ad Hoc Infinity version 2.4, consider restricting access to the `/servlet/Report` and `/jsp/zimg upload.jsp` endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A SQL injection issue in the "Search" functionality of the "tickets.php" page allows authenticated attackers to execute arbitrary SQL commands via the combination of `keywords` and `topic id` URL parameters.

The issue allows for CSV injection through a crafted `user name` that is mishandled during export from the activity logs in the Audit Area.

The issue allows for stored XSS via a crafted avatar field within My Account JSON data to the "Account.aspx" endpoint. This can be exploited by manipulating the `avatar` field in the JSON data.