Robin Verton

Name of the Vulnerable Software and Affected Versions: ServiceNow versions prior to Release Jakarta Patch 8 Description: The issue allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the `sysparm media` parameter of the report viewer.do endpoint. Recommendations: For versions prior to Release Jakarta Patch 8, update to a version newer than Release Jakarta Patch 8 to resolve the issue. As a temporary workaround, consider restricting access to the `sysparm media` parameter in the report viewer.do endpoint until a patch is available.

The issue is related to an unsafe password reset token generation in the user component, which can lead to password reset. This can be exploited via an HTTP request.

The issue is related to a Server-Side request forgery vulnerability in the webhook component. This can lead to unauthorized read or update of internal resources. The attack is exploitable via an HTTP request.

The issue is related to a SQL Injection vulnerability in the album component, which can lead to SQL code injection. This can be exploited via an HTTP request.

The issue is related to a PHP Type juggling vulnerability in the album view component, which can lead to authentication bypass. This can be exploited via an HTTP request.

The issue concerns the wiki decode Developer System Helper function in the admin panel, which allows remote attackers to conduct PHP object injection attacks. This enables the execution of arbitrary PHP code via a crafted serialized object.

The issue concerns the getUserzoneCookie function, which uses a hardcoded cookie secret to validate cookie signatures. This allows remote attackers to bypass an intended protection mechanism, conduct PHP object injection attacks, and execute arbitrary PHP code via a crafted userzone cookie.

The issue allows remote attackers to bypass authentication by utilizing a `ws auth` cookie.

The issue allows remote attackers to execute arbitrary SQL commands via a `ws auth` cookie. This is a distinct issue from other known vulnerabilities.

The issue allows remote attackers to obtain sensitive configuration information because certain files, specifically `phpinfo.php` and `check.php`, remain accessible under the `/docs/` directory after installation. The vendor disputes this issue, stating it could only occur if the administrator ignores installation instructions and warnings generated by `check.php`.

The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities in the modules.php file when magic quotes gpc is disabled. This is achieved by exploiting the `name`, `sid`, and `pid` parameters in a POST request, which bypasses the security checks performed for GET requests.

The issue allows remote attackers to bypass authentication and execute arbitrary SQL commands. This can be achieved via the `username` or `password` to admin/admin validate login, or the `login`, `password`, and `flag` parameters to "login validate.php".

The issue allows remote attackers to execute arbitrary SQL commands via the `username` field in the admin/index.php file.

The issue allows remote attackers to execute arbitrary PHP code via the `config[basepath]` parameter in the payment paypal.php file.

A direct static code injection issue exists in the admin options manage.php file, allowing attackers to execute arbitrary PHP code via the `number` parameter. It is unclear whether administrator privileges are required to exploit this issue.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities are found in the Err parameter in `admin/index.php` and the `firstname` and `lastname` parameters in `index.php`.

The issue allows remote attackers to obtain sensitive information by making a direct request to certain scripts, including `togateway.php` and other unspecified scripts.

The issue allows remote attackers to obtain the full path via unspecified vectors due to an unspecified vulnerability in the subheader.php file.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `forum id` parameter to "options.php" or the `lastvisited` parameter to "viewforum.php".

The issue allows remote attackers to include arbitrary local files via the `siteurl` parameter when `register globals` is enabled.