Nikita Petrov

A vulnerability in Veeam Service Provider Console has been identified, which allows an attacker to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources. This issue is related to insufficient protection of service data. The vulnerability can be exploited by sending specially crafted HTTP requests. It is estimated that over 2500 vulnerable systems are accessible from the internet, with the majority located in the USA and Turkey. Among the users of Veeam products are 74% of companies from the Forbes Global 2000 list, making this vulnerability particularly attractive to hackers.

The issue is related to the incorrect neutralization of special elements used in SQL commands, which can allow a remote attacker to modify the logic of a database query by injecting arbitrary SQL operators. The GLPI inventory endpoint can be used to drive a SQL injection attack.

The issue is related to incorrect neutralization of special elements in output, which can allow a remote attacker to execute arbitrary code. The LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document on PHP 7.4 only.

The issue is related to incorrect access control in the Veeam Backup & Replication Distribution Service, which can be exploited by a remote attacker to execute arbitrary code by uploading specially crafted data through TCP port 9380. This is a remote code execution vulnerability.

An improper limitation of path names allows remote authenticated users to access internal API functions. This access could allow attackers to upload and execute arbitrary code. The issue is related to the Distribution Service and involves deficiencies in access control. Exploitation occurs through the TCP port `9380`. The vulnerability allows attackers to upload specially crafted data.

The issue is related to the deserialization of untrusted data, which can be exploited by sending specially crafted data through TCP-port 9395. This allows local users to run arbitrary code with local system privileges.

The issue allows NoSQL injection via the `check` function in `Controller/Auth.php`.

The issue allows NoSQL injection via the `newpassword` function in the `Controller/Auth.php` file.

The issue allows NoSQL injection via the `resetpassword` function in the `Controller/Auth.php` file.