Marcin Wyczechowski

The prezip-bin utility contains a heap-based buffer overflow in the decompressor located in prog/prezip.c. The decompressor fails to properly validate buffer space, allowing a specially crafted compressed file to trigger out-of-bounds read and write operations on the heap. This memory corruption can lead to a process crash if a user is persuaded to process a malicious file.

An integer truncation issue exists in the `WritableDict::add()` function within the modules/speller/default/writable.cpp file. When loading a personal wordlist, the software stores the word length as a single byte, which causes truncation for words with lengths that are multiples of 256. This behavior leads to heap corruption, allowing an attacker to cause a denial of service by convincing a user to process a specially crafted personal wordlist.

An out-of-bounds read exists in the `ReadOnlyDict::load()` function within `readonly ws.cpp`. The issue occurs when loading a binary .rws dictionary file, as the software uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. A remote actor can exploit this by inducing a user to run the application with a specially crafted dictionary file provided via the `--master` or `--dict-dir` flags, or through configuration options. This can result in the disclosure of heap memory or a denial of service caused by an application crash.

Local argument injection is possible through the process termination functionality. The software passes the process name directly to the `pkill` command without proper sanitization. A local attacker can create a process with a name starting with `--` (for example, including a target user's UID). If a user running the application invokes the kill feature on this process, `pkill` treats the crafted name as a command-line option, resulting in the termination of all processes owned by the targeted user.

The application is susceptible to symlink following when the `--devel` flag is active. This occurs because the software opens a log file without the `O NOFOLLOW` flag, which is a system-level instruction that prevents the application from following symbolic links. A local attacker can create a symlink at the expected log file path that points to a sensitive file, leading the application to truncate and overwrite the target file with log data. This impact is increased if the application is executed with elevated privileges.

The software is susceptible to CSV injection during the data export process to CSV files. This occurs because the application fails to sanitize cell content that begins with special formula characters such as `=`, `+`, `-`, or `@`. A local attacker can exploit this by creating a process with a crafted name starting with `=`, which injects malicious formulas into the CSV output. These formulas are then executed when a victim opens the resulting file in a spreadsheet application.

GNU wget is susceptible to a denial of service in its FTP OPIE/S-KEY authentication functionality. The issue occurs because the software uses a server-supplied sequence number from the FTP challenge line as an iteration count for an MD5 key-derivation loop without validating an upper bound. A malicious FTP server or a network attacker capable of intercepting traffic can send a crafted OPIE challenge with a sequence number near `INT MAX`, forcing the application to perform approximately 2.1 billion MD5 computations. This results in the application suspending for a significant period. The `--timeout` option is ineffective as it only applies to network I/O and not CPU computation.

The profile update functionality is susceptible to Cross-Site Request Forgery (CSRF), a flaw where a web application fails to verify that a request was intentionally initiated by the user. An attacker can create a malicious website that, when accessed by an authenticated user, sends a forged request to the system. Because the application lacks proper CSRF token implementation, it processes the request, enabling the attacker to modify the profile fields of the user.

An Insecure Direct Object Reference (IDOR) exists in endpoints related to profile pictures. An authenticated user can provide a different user's `member id` within a POST request to the profile album endpoint to permanently delete that user's profile picture, regardless of whether the target is a student, instructor, or administrator.

Stored Cross Site Scripting (XSS) exists in the registration functionality. An attacker can register a new account and inject a JavaScript payload into the `phone` field. When an authenticated user views the attacker's public profile, the profile template renders the `phone` value without output encoding, causing the browser to execute the payload and potentially allowing the theft of the user's session cookie.

A Path Traversal issue exists in the ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive to write files outside the intended directory. This allows the placement of a server-executable `.phtml` file in the web root, leading to remote code execution with web server privileges on the underlying server.

A path traversal vulnerability allows an authenticated user to access files from other course directories. This occurs when the `AT FORCE GET FILE` configuration option is enabled, potentially leading to unauthorized file access and disclosure of the filesystem structure. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

A path traversal vulnerability exists in the error log viewer. This flaw allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory, potentially leading to unauthorized access to sensitive files and other resources accessible to the web server process. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

An authentication bypass exists in the auto-login functionality. While a token validation check is implemented, the values required for this validation remain uninitialized in specific code paths. An unauthenticated attacker who obtains a user's identifier and registration timestamp can generate a valid token to authenticate as any existing user, including administrators, without providing a password.

An authenticated attacker can perform a Reflected Cross-Site Scripting (XSS) attack via the `popup` parameter in the 'preview.php' endpoint. By injecting a double quote into the `popup` parameter, the attacker can break out of the attribute value and append a new event handler, such as `onload`. Although the 'preview top.php' file sanitizes these parameters, it does not prevent XSS within the parent frameset rendered by 'preview.php'.

The Gameme module allows authenticated users to upload files of any type and extension without restriction. Because files are stored in a web-accessible location before content validation, an attacker with a valid `course id` (often `course id=0` for global context) can upload a server-executable malicious script. Requesting this file over HTTP leads to remote code execution with the privileges of the web server process user.

The account confirmation functionality generates predictable email confirmation tokens because it uses insufficiently random values related to user registration. An attacker capable of predicting these values can guess valid activation tokens to activate an unconfirmed account without accessing the victim's email inbox.

An authorization bypass exists where a low-privileged authenticated user, such as a student enrolled in a course, can send requests directly to the backend import endpoints. This allows the unauthorized import of tests and questions within a course. The affected endpoints are the Test and Question Import endpoints.

An authenticated administrator can perform Server-Side Request Forgery (SSRF) through import functionalities. This allows the server to make requests to arbitrary internal HTTP endpoints, cloud metadata services, or local files using the `file://` wrapper, provided the PHP environment permits URL wrappers. SSRF is a flaw where an attacker induces a server-side application to make requests to an unintended location.

Reflected Cross-Site Scripting (XSS) exists in the restore functionality. This occurs when an attacker provides a specially crafted URL that, if opened by a victim, executes arbitrary JavaScript in the victim's browser. Reflected XSS is a type of attack where a malicious script is reflected off a web application to the victim's browser.