Lukasz-Rybak

Server-side template injection occurs because user-controlled message fields are not validated before template rendering, which allows expressions to run in an unrestricted context. Authenticated attackers with a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.

PlantUML Macro, used for rendering UML diagrams from textual schemes, contains a Server-Side Request Forgery (SSRF) flaw. The application fails to validate the URL provided through the `server` parameter, allowing an attacker to specify an internal IP address or a malicious external URL. Consequently, the XWiki server attempts to connect to the supplied URL to render the diagram.

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. An authenticated administrator can achieve remote code execution as the web server user by injecting arbitrary OS commands into the `MAIN ODT AS PDF` configuration constant. This occurs during the ODT to PDF conversion process in 'odf.php', where the constant is concatenated directly into a shell command passed to the `exec()` function without proper sanitization. Approximately 56.8K services are estimated to be affected worldwide.

A sandbox bypass exists in the optional Twig safe mode feature `CMS SAFE MODE`. Certain methods on the `collect()` helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. This issue only affects installations where `CMS SAFE MODE` is enabled, which is disabled by default, and requires authenticated backend access with CMS template editing permissions.

OpenSTAManager is a management software for technical assistance and invoicing. The application does not properly sanitize user-supplied input from the `righe` GET parameter before reflecting it in HTML output. Specifically, the `$ GET['righe']` parameter is directly echoed into the HTML value attribute without sanitization, potentially allowing an attacker to inject arbitrary HTML or JavaScript. This is a Reflected Cross-Site Scripting (XSS) issue.

TypiCMS is a content management system built on the Laravel framework. A stored cross-site scripting (XSS) issue exists in the file upload functionality. The application permits users with file upload privileges to upload SVG files, but it does not properly sanitize the file content despite MIME type validation. An attacker can upload a malicious SVG file containing JavaScript code. When another user views the file, the script executes in their browser, potentially compromising their session. The vulnerability is not mitigated by a 500 error that can occur if the SVG file lacks a `viewBox` attribute, as attackers can include a valid `viewBox` attribute in their payload.

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal issue exists in the `get file` method of the `Guest` module's `Get` controller. This allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This can lead to the disclosure of sensitive information, including configuration files with database credentials. The vulnerable method is `get file` within the `Guest` module's `Get` controller. The input filename is the vulnerable parameter.

OpenSTAManager contains a critical Error-Based SQL Injection issue within the Scadenzario (Payment Schedule) module’s bulk operations handler. The application does not properly validate that elements within the `id records` array are integers before utilizing them in an SQL IN() clause. This allows attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages. The vulnerable parameter is `id records[]` and is accessible through the `/actions.php?id module=18` API endpoint. The vulnerability stems from the application's failure to validate input types, specifically allowing non-integer values within the `id records` array to be directly concatenated into an SQL query without proper sanitization. This enables attackers to manipulate the SQL query and extract data, including user credentials, customer Personally Identifiable Information (PII), and financial records.

OpenSTAManager contains a critical Error-Based SQL Injection issue within the Prima Nota (Journal Entry) module's add.php file. The application does not validate that comma-separated values received through the `id documenti` GET parameter are integers before utilizing them in SQL IN() clauses. This allows attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages. The vulnerable parameter is `id documenti` and the affected API endpoint is `/modules/primanota/add.php`. The vulnerability resides in lines 63-67 and 306 of the add.php file. The application retrieves user-controlled URL parameters using the `get()` function, splits them by comma, and then concatenates the array elements directly into a SQL query without any type validation. This enables attackers to inject SQL code by providing a malicious payload to the `id documenti` parameter.

OpenSTAManager contains a critical Time-Based Blind SQL Injection vulnerability in the article pricing completion handler. The application does not properly sanitize the `idarticolo` parameter before using it in SQL queries, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference. The vulnerability exists in the `/ajax complete.php` file, specifically in the `/modules/articoli/ajax/complete.php` module. The vulnerable parameter is `idarticolo` within the GET request to the `/ajax complete.php?op=getprezzi` endpoint. The vulnerability allows authenticated attackers to extract complete database contents, including user credentials, customer data, and financial records. A proof-of-concept (PoC) demonstrates the extraction of the database name, admin username, and password hash. The root cause is the inconsistent use of the `prepare()` function, which is used to sanitize the `idanagrafica` parameter but not the `idarticolo` parameter.

OpenSTAManager contains a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application does not properly sanitize the `term` parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference. The vulnerability affects multiple search modules and has amplified execution, meaning a single malicious request can trigger SQL injection across all vulnerable modules simultaneously, increasing the delay and potentially causing server issues. The vulnerable parameter is `term` and is used in the `/ajax search.php` endpoint. Affected modules include Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, Contratti, Automezzi, and Interventi. The vulnerability allows for complete database exfiltration, including customer Personally Identifiable Information (PII), financial records, and business secrets, as well as the extraction of password hashes.

FacturaScripts, an open-source enterprise resource planning and accounting software, contains a critical SQL injection issue in its REST API. Authenticated API users can execute arbitrary SQL queries through the `sort` parameter. The issue resides in the `getOrderBy()` method of the `ModelClass`, where user-supplied sorting parameters are directly incorporated into the SQL ORDER BY clause without proper validation or sanitization. This impacts all API endpoints that support sorting functionality.

FacturaScripts is enterprise resource planning and accounting software. Versions prior to 2025.81 contain a critical SQL injection issue in the autocomplete functionality. Authenticated attackers can extract sensitive data from the database, including user credentials, configuration settings, and business data. The issue is located in the `CodeModel::all()` method, where user-supplied parameters are directly concatenated into SQL queries without proper sanitization or parameterized binding.

EGroupware is a web-based groupware server written in PHP. A SQL Injection issue exists in the core components of EGroupware, specifically in the `Nextmatch` filter processing. Authenticated attackers can inject arbitrary SQL commands into the `WHERE` clause of database queries. This is possible due to a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the `is int()` security check. The vulnerable component is the `Nextmatch` filter.

Saleor, an e-commerce platform, permitted authenticated staff users or Apps to upload arbitrary files, including potentially malicious HTML and SVG files containing Javascript. If media files are hosted on the same domain as the dashboard, these files could be served without restrictions, leading to the execution of malicious scripts within the user's browser. A malicious staff member could potentially inject scripts to target other staff members, potentially compromising their access and refresh tokens. The issue is present when media files are not served with a `Content-Disposition: attachment` header. Saleor Cloud users are not affected. The vulnerable API endpoint is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified.

Saleor, an e-commerce platform, permitted modification of rich text fields with HTML without backend sanitization. This allowed malicious actors to execute stored cross-site scripting (XSS) attacks on both dashboards and storefronts. Specifically, malicious staff members could inject scripts to target other staff members, potentially compromising their access and refresh tokens. The issue impacts the ability to properly handle HTML input in rich text fields, potentially leading to unauthorized code execution within the platform.

The software contains a flaw due to a regression of a previous fix, allowing the execution of unchecked PHP Closures within the `map()` override function. This could potentially lead to remote code execution. The issue stems from an insufficient allow list check for PHP Closures used in the `map()` function.

REDAXO is a PHP-based content management system. Authenticated users with backup permissions can read arbitrary files within the webroot due to a path traversal issue in the Backup addon’s file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against a permitted directory allowlist. An attacker can use relative paths containing `../` sequences, or even absolute paths within the document root, to include any readable file in a generated `.tar.gz` archive. The `EXPDIR` parameter is vulnerable to path traversal.

ChurchCRM is an open-source church management system with a SQL Injection issue present in a legacy endpoint. The vulnerability exists in the `/Reports/ConfirmReportEmail.php` endpoint and is exploitable through the `familyId` parameter. Any authenticated user, even with limited permissions, can trigger the SQL injection. The vulnerable code, though removed from the user interface, remains accessible directly via URL, representing a case of 'dead but reachable code'.

ChurchCRM is an open-source church management system. A flaw exists where an authenticated user with specific permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile. This payload executes when an administrator views their profile, potentially allowing an attacker to hijack the administrator’s session and perform administrative actions, leading to a full account takeover. The issue is a result of an Insecure Direct Object Reference (IDOR) allowing unauthorized profile viewing, combined with a Broken Access Control vulnerability permitting modification of user record properties.