Mokksh Parekh

Insufficient escaping of search values used in SQL queries within several admin listings allows authenticated users with administrative access to perform SQL injection attacks. This occurs due to a lack of sufficient preparation of the SQL query and improper handling of user-supplied parameters, enabling attackers to append additional queries to extract sensitive information from the database.

An authorization check is missing in the lead-export handler, which allows unauthenticated users to download all captured contact records, including names, email addresses, and phone numbers. This occurs via the `click n chat update lead list export action` handler.

Insufficient authorization checks in an AJAX action allow unauthenticated users to modify the status of arbitrary appointments. This flaw also enables the triggering of notification emails to the affected customers via the `update appointment status` action.

Authenticated users with a clinic staff-level role can perform SQL injection because the software fails to properly sanitize and escape user-supplied parameters before incorporating them into a SQL query. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Insufficient sanitization and escaping of a search parameter in an administrative listing allows authenticated users with booking-management roles or higher to perform SQL injection. This occurs because the plugin fails to properly prepare the SQL query, enabling attackers to append additional queries to extract sensitive information from the database.

An issue exists where user-supplied input is not properly sanitized or escaped before being used in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks, which occur when malicious SQL statements are inserted into entry fields for execution. This flaw is exploitable within the standard front-end issue-tracker configuration via the search parameter.

An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database.

Command Injection occurs due to improper sanitization of user input used in git shell commands. The ` cloneWithGit()` and `fetchRefs()` functions directly invoke these commands using the `exec()` method. An attacker can execute arbitrary operating system commands as the process user by providing a specially crafted git repository name. This issue primarily affects template generators, project bootstrappers, and CI pipelines that process untrusted repository identifiers.