Riccardo Krauter

The issue allows remote attackers to execute arbitrary commands. This is achieved via the `m1 sortby` parameter to the "modules/News/function.admin articlestab.php" endpoint.

The issue allows remote authenticated attackers to gain a webshell via a crafted phar file. This is achieved through a file upload vulnerability.

The issue allows an attacker to execute arbitrary commands on the remote server due to a path traversal vulnerability. This occurs when the `homedirs` option is used.

The issue concerns SQL injection in the modules/News/function.admin articlestab.php file. Specifically, the `$sortby` variable is concatenated with `$query1`, allowing for the injection of arbitrary SQL language without using the '.' character.

The issue allows for directory traversal, potentially leading to remote code execution. This can be achieved by uploading a specially crafted txt file into the lib directory due to a `wfu include lib` call.

An issue in Total.js CMS allows an authenticated user with the Pages privilege to conduct a path traversal attack to include .html files outside the permitted directory. If a page contains a template directive, it will be server-side processed, potentially leading to Remote Command Execution if a user can control the content of a .html file and inject a malicious template directive.

A security issue in Total.js CMS allows a low-privilege user to transform a cookie and obtain the random values inside it. If an attacker discovers a session cookie owned by an admin, they can brute force it with reduced complexity, potentially leading to the theft of the admin password.

An issue allows an authenticated user with the widgets privilege to achieve Remote Command Execution (RCE) on the remote server. This is done by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server-side. The back-end's evaluation of the tag allows an attacker to escape the sandbox object using a specific payload: `<script total>global.process.mainModule.require(child process).exec(RCE);</script>`.

An issue in Total.js CMS allows an authenticated user with limited privileges to access a resource they do not own by calling the associated "API". The product manages privileges correctly only for the front-end resource path, but not for "API" requests, leading to vertical and horizontal privilege escalation.