Såawomir Zakrzewski

The issue allows users to upload files of any type and extension without restriction in the Profile section of the Ready application. If the server is misconfigured, it can result in Remote Code Execution. This misconfiguration was present by default in installations from late 2021 and early 2022.

The issue arises from the improper neutralization of user input in a file search function within the invoices module, allowing for SQL Injection attacks. This can be exploited by a low-privileged user.

The issue allows a low-privileged user to provide a link to a local file using the `file://` protocol, enabling the attacker to read the content of the file. This can be used to read the content of system files.

A cross-site scripting (XSS) issue in the upload functionality of Ready File Explorer allows the injection of arbitrary JavaScript code in the filename. The injected content is stored on the server and is executed every time a user interacts with the uploaded file.

The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint "/sofer/DocumentService.asc/SaveAnnotation", where input data transmitted via the POST method in the parameters `author` and `text` are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content.

The SAS application is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input validation in the ` program` parameter of the "/SASStoredProcess/do" endpoint. This allows arbitrary JavaScript to be executed when a specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user.