P. Morimoto

Name of the Vulnerable Software and Affected Versions: Yeager CMS version 1.2.1 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the `passwordreset&token` parameter. Recommendations: For Yeager CMS version 1.2.1, avoid using the `passwordreset&token` parameter until the issue is resolved. As a temporary workaround, consider restricting access to the password reset functionality to minimize the risk of exploitation.

The issue allows an unprivileged user to control the contents of XML files, which can be used as an attack vector. This is due to the XML parser's ability to access storage on external systems through XML external entities (XXE). As the XML parser runs with the permissions of the web server and has access to the local filesystem, it can access any file readable by the web server and copy it to an external system chosen by the attacker. This could include files containing passwords, potentially leading to privilege escalation.

The issue is related to a reflected cross-site scripting (XSS) vulnerability present in the VisualRF component. This vulnerability can be exploited by an attacker who tricks a logged-in administrative user into clicking a malicious link, potentially allowing the attacker to obtain sensitive information such as session cookies or passwords. The exploitation requires the administrative user to click on the link while logged into Airwave in the same browser.

The issue allows for unauthenticated remote code execution due to a default component that permits arbitrary upload of PHP files. This is possible because the formmailer widget blocks .php files but not .php5 or .phtml files, which can be exploited. The vulnerability is related to the `/assets/php/formmailer/SendEmail.php` and `/assets/php/formmailer/functions.php` files.

The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension, due to an unrestricted file upload vulnerability.

The issue concerns a SQL injection vulnerability in the password recovery feature. This vulnerability allows remote attackers to change the account credentials of known users via the `userEmail` parameter.

The issue allows remote attackers to trigger outbound requests and enumerate open ports. This is achieved via the `dbhost` parameter to specific API endpoints, including 'libs/org/adodb lite/tests/test adodb lite.php', 'libs/org/adodb lite/tests/test datadictionary.php', or 'libs/org/adodb lite/tests/test adodb lite sessions.php'.

The issue allows local users to execute arbitrary SQL commands. This is achieved via the `pagedir orderby` parameter in the "yeager/y.php/tab USERLIST" endpoint.