Mark Stanislav

Name of the Vulnerable Software and Affected Versions: IZON IP version 2.0.2 Description: The issue is related to a hard-coded password, which could potentially allow unauthorized access. Recommendations: For IZON IP version 2.0.2, update the device to remove the hard-coded password to mitigate the risk.

The issue allows remote attackers to obtain sensitive information or modify data on the Fisher-Price Smart Toy Bear devices. This can be achieved by leveraging presence in an 802.11 network's coverage area and entering an account number.

The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the `module` parameter of the index.php file. This is a directory traversal vulnerability.

The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the `lang` parameter of the index.php file. This is a directory traversal vulnerability.

The issue allows remote attackers to execute arbitrary SQL commands via the `password` parameter in the loginscript.php file. This can lead to unauthorized access and manipulation of database content.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `country` parameter in the getcity.php file.

The issue allows remote attackers to read the database. This is achieved through the 'admin/index.php' file when a 'SaveSQL' action is performed.

The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to data manipulation or extraction. This can be achieved through various API endpoints, including "a viewusers.php" and "keysearch.php" via the `s` parameter, and for authenticated administrators, through "pending.php" via the `id` or `start` parameters, or "a authordetails.php" via the `aid` parameter.

The issue allows remote attackers to read or delete arbitrary files due to directory traversal vulnerabilities. This can be achieved by using a .. (dot dot) in the `p` parameter in either a preview or delete action to "index.php".

The issue allows remote attackers to inject arbitrary web script or HTML via the `default news` or `sponsors` cookies. These cookies are not properly handled by controllers such as `controllers/index.ctrl.php` or `controllers/settings.ctrl.php`.

The issue allows remote attackers to bypass authentication and obtain administrative privileges. This is achieved by setting arbitrary values of the `auser` and `apass` cookies.

The issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the `p` parameter to "index.php".

The issue allows remote authenticated users to execute arbitrary code by uploading a .php file to the `fileman file upload.php` script and then accessing it via a direct request to the file in the uploads directory.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `namecondition` or `namesearch` parameter in the "search.php" file.