Mirdavlatov Mirazam

**Name of the Vulnerable Software and Affected Versions** IOTSmartHome (affected versions not specified) **Description** The `checkCookie()` function in the 'gui/login.php' endpoint is susceptible to SQL injection. The issue occurs when the system processes the `lastLogin` cookie using the `safe decode()` function, which performs URL-safe base64 decoding without sanitizing the resulting value before incorporating it into a SQL query. An unauthenticated attacker can provide a base64-encoded payload within the `lastLogin` cookie to bypass authentication or use UNION-based injection to extract sensitive data, such as user credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the 'gui/login.php' endpoint or disable the use of the `lastLogin` cookie.

**Name of the Vulnerable Software and Affected Versions** MacCMS10 (affected versions not specified) **Description** The admin template editor in `application/admin/controller/Template.php` uses a blacklist regex to block dangerous PHP functions in template content. However, the blacklist fails to include `exec`, `passthru`, `popen`, `show source`, `create function`, `register shutdown function`, `register tick function`, and `error log`. An authenticated administrator can exploit this by using the ThinkPHP `{if}` template tag, which embeds the `condition` attribute directly into raw PHP, allowing for remote code execution. **Recommendations** Apply the fix provided in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 to update the function filter.

**Name of the Vulnerable Software and Affected Versions** Miantang/IoT-PHP (affected versions not specified) **Description** The `index.php` file implements a POST '/userlogin' endpoint that is susceptible to SQL injection. The application reads the password from the `pwd` variable without sanitization and concatenates it into a raw SQL query. While the username is processed via `htmlspecialchars()`, this function does not encode single quotes by default, failing to prevent injection. An unauthenticated attacker can use a payload in the `pwd` variable to bypass authentication or employ UNION-based injection to extract arbitrary data from the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `pwd` parameter in the '/userlogin' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** DjangoCRM (affected versions not specified) **Description** The software contains a hardcoded `SECRET KEY` within the `webcrm/settings.py` file instead of retrieving it from an environment variable. This key is critical for session signing, CSRF token generation, and password reset tokens. An attacker with access to the public repository can use this key to forge valid session cookies, including those for the superadmin account, as well as forge CSRF and password reset tokens, leading to full account takeover. Additionally, the default configuration has `DEBUG` set to `True`, which allows error pages to leak sensitive information such as database credentials, email credentials, OAuth data, and internal file paths. **Recommendations** Change the hardcoded `SECRET KEY` in `webcrm/settings.py` to a unique, random value and configure the application to read it from an environment variable. Set the `DEBUG` variable to `False` in the production configuration to prevent the leakage of sensitive system information.

**Name of the Vulnerable Software and Affected Versions** DjangoCRM (affected versions not specified) **Description** The massmail module fails to sanitize user-controlled `EmlMessage` fields, specifically `subject` and `content`, when rendering them through the Django `Template()` constructor. This issue occurs in `message previews.py`, `email creators.py`, and `helpers.py`. An authenticated user with mass-mail message edit rights can perform Server-Side Template Injection (SSTI) by injecting Django template syntax. This can lead to the disclosure of password hashes and other users' data via request context variables, CSRF token forgery, and the inclusion of arbitrary registered templates. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DjangoCRM (affected versions not specified) **Description** The `toggle default sorting` view in `common/urls.py` lacks authentication wrappers such as `login required` or `staff member required`. The view redirects to a destination specified by the `next url` GET parameter after validating it with the `secure url()` function. However, this function only verifies that the target host matches the current site domain, failing to prevent redirects to any internal path. This flaw allows unauthenticated users to perform phishing redirects and cause referrer-based token leakage through redirect chains. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.