Neosprings

**Name of the Vulnerable Software and Affected Versions** Sprig Plugin for Craft CMS versions prior to 2.15.2 Sprig Plugin for Craft CMS versions prior to 3.15.2 **Description** The Sprig Plugin for Craft CMS allows admin users and those with Sprig Playground access to potentially reveal security keys, credentials, and other sensitive configuration data. The `hashData()` function can also be executed. This issue was addressed by disabling Sprig Playground access when `devMode` is disabled, with a configuration option (`enablePlaygroundWhenDevModeDisabled`) to override this behavior. **Recommendations** Update to Sprig Plugin for Craft CMS version 2.15.2 or later. Update to Sprig Plugin for Craft CMS version 3.15.2 or later.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 5.9.0-beta.1 through 5.9.10 **Description** Craft CMS is a content management system. In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s `fullName` as raw HTML due to the use of `Template::raw()` combined with `Craft::t()` string interpolation. A low-privileged control panel user (e.g., Author) can set their `fullName` to an XSS payload via the profile editor, then create an entry with two saves. If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator. **Recommendations** Update to Craft CMS version 5.9.11.

**Name of the Vulnerable Software and Affected Versions** Webhooks for Craft CMS plugin versions 3.0.0 through 3.1.9 **Description** The Webhooks plugin for Craft CMS allows management of webhooks, which send GET or POST requests upon specific events. Versions 3.0.0 through 3.1.9 render user-supplied template content using Twig’s `renderString()` function without sandbox protection. This enables an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code capable of calling arbitrary PHP functions. This is possible even if `allowAdminChanges` is set to `false`. The issue involves Server-Side Template Injection (SSTI). **Recommendations** Update to version 3.2.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Amazon S3 for Craft CMS versions 2.0.2 through 2.2.4 **Description** The Amazon S3 for Craft CMS plugin integrates Amazon S3 with Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of buckets the plugin has access to. The `BucketsController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is permitted to access. **Recommendations** Update the plugin to version 2.2.5.

**Name of the Vulnerable Software and Affected Versions** Azure Blob Storage for Craft CMS plugin versions prior to 2.1.1 **Description** The Azure Blob Storage for Craft CMS plugin integrates Azure Blob Storage with Craft CMS. Versions prior to 2.1.1 allow unauthenticated users to view a list of buckets the plugin has access to. The `/DefaultController->actionLoadContainerData()` API endpoint permits unauthenticated users possessing a valid CSRF token to enumerate accessible buckets. Due to the potential for sensitive data exposure in Azure error messages, additional attack vectors may be present. **Recommendations** Update to version 2.1.1 of the plugin.

**Name of the Vulnerable Software and Affected Versions** Craft versions prior to 5.9.9 **Description** Craft is a content management system (CMS). The `ElementSearchController::actionSearch()` API endpoint lacks the `unset()` protection that was added to `ElementIndexesController`. This results in a SQL injection issue, specifically affecting parameters like `criteria[orderBy]`. Any authenticated control panel user can inject arbitrary SQL through `criteria[where]`, `criteria[orderBy]`, or other query properties. This allows for the extraction of the full database contents via boolean-based blind injection. **Recommendations** Update to version 5.9.9 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Craft versions prior to 5.9.9 Craft versions prior to 4.17.4 **Description** Craft is a content management system (CMS). A Remote Code Execution issue exists in the Craft CMS 5 conditions system. The `BaseElementSelectConditionRule::getElementIds()` method passes user-controlled string input through `renderObjectTemplate()`, a Twig rendering function that lacks sandboxing and has escaping disabled. Any authenticated Control Panel user, including those with non-administrative roles like Author or Editor, can achieve full Remote Code Execution by sending a specially crafted condition rule through standard element listing endpoints. This issue does not require administrator privileges or special permissions beyond basic Control Panel access and bypasses all production hardening settings. The `renderObjectTemplate()` function is involved in the issue. **Recommendations** Craft versions prior to 5.9.9 should be updated to version 5.9.9. Craft versions prior to 4.17.4 should be updated to version 4.17.4.

**Name of the Vulnerable Software and Affected Versions** Sylius versions 1.9.12 through 1.11.17 Sylius versions 1.12.23 through 1.13.15 Sylius versions 1.14.18 through 2.0.16 Sylius versions 2.1.12 through 2.2.3 **Description** Sylius is an Open Source eCommerce Framework on Symfony. The `ProductPriceOrderFilter` and `TranslationOrderNameAndLocaleFilter` API filters do not validate user-supplied order direction values before passing them to Doctrine's `orderBy()` function, allowing for arbitrary DQL injection. The filters pass the `order` direction directly to the `orderBy()` function without proper sanitization. This could allow an attacker to manipulate database queries. **Recommendations** Update to Sylius version 1.9.12 or later. Update to Sylius version 1.10.16 or later. Update to Sylius version 1.11.17 or later. Update to Sylius version 1.12.23 or later. Update to Sylius version 1.13.15 or later. Update to Sylius version 1.14.18 or later. Update to Sylius version 2.0.16 or later. Update to Sylius version 2.1.12 or later. Update to Sylius version 2.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Statmatic versions prior to 6.3.3 Statmatic versions prior to 5.73.10 **Description** An attacker can exploit a flaw in the password reset functionality to obtain a user's token and subsequently reset their password. The attacker requires the email address associated with a valid account. Successful exploitation depends on the user unknowingly clicking a link in an email they did not initiate. The vulnerable feature involves the password reset process, potentially impacting user account security. **Recommendations** Update to Statmatic version 6.3.3 or later. Update to Statmatic version 5.73.10 or later.

**Name of the Vulnerable Software and Affected Versions** Statamic versions prior to 5.73.6 Statamic versions prior to 6.2.5 **Description** Statamic is a Laravel and Git powered CMS designed for building websites. Users without the necessary permissions to view assets are able to download them and view their metadata. Logged-out users and users without access to the control panel are not affected by this issue. **Recommendations** Update to version 5.73.6 or later. Update to version 6.2.5 or later.

**Name of the Vulnerable Software and Affected Versions** Statamic versions 6.0.0 through 6.2.2 **Description** Statamic is a Laravel and Git powered content management system (CMS). A stored cross-site scripting (XSS) issue exists in content titles, allowing authenticated users with content creation permissions to inject malicious JavaScript. This JavaScript executes when viewed by users with higher privileges. An attacker with content control panel access can exploit this to create super administrator accounts. The vulnerable component is the content title functionality. The affected API endpoint is not specified. The vulnerable parameter is not specified. **Recommendations** Upgrade to version 6.2.3 or later.

Name of the Vulnerable Software and Affected Versions Craft Commerce versions prior to 5.6.0 Description An SQL injection exists in the ecommerce platform for Craft CMS. The `hasVariant` property of `ProductQuery` and the `hasProduct` property of `VariantQuery` bypass the input sanitization blocklist in `ElementIndexesController`. These properties internally call the `(Craft::configure())` function on a subquery without sanitization. Authenticated control panel users can exploit this via boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation. Recommendations Update to version 5.6.0. As a temporary workaround, avoid using the `hasVariant` and `hasProduct` properties in queries until the update is applied.