Saidakbarxon Maxsudxonov

Improper access control in the storage adapter allows authenticated users to bypass collection-level permissions. By directly accessing the 'client-upload' endpoint, attackers can upload files without the necessary collection access permissions, circumventing intended security enforcement.

A path traversal issue exists in the self-update API. Authenticated company owners can write arbitrary files outside the intended extraction directory by providing crafted ZIP archives containing `../` sequences to the `/unzip` endpoint. This occurs because unsanitized ZIP entry names are passed to the `ZipArchive::extractTo()` function, allowing attackers to place arbitrary PHP files into the web-accessible public directory and achieve remote code execution (RCE), which is the ability to execute arbitrary commands on the server.

An insecure direct object reference (IDOR) allows authenticated low-privileged attackers to escalate privileges by exploiting a parameter confusion flaw in the `UsersController` between the authorization filter and the action body. By sending a PATCH request to the 'updated ajax' endpoint, an attacker can set the `id` parameter to their own user ID to bypass self-authorization checks while setting the `user id` parameter to a victim's ID. This causes the controller to load and modify the victim's account, enabling the attacker to overwrite administrator passwords and achieve full site takeover.

A missing authorization issue exists in the admin users controller. An authenticated user can access the profile data of any other user, including administrators, by sending a GET request to the admin profile endpoint using an enumerable sequential integer in the `user ID` parameter. This occurs because the profile action is excluded from the role validation filter and lacks an ownership check.

A stored cross-site scripting issue exists in the mobile dashboard. Authenticated attackers can inject arbitrary HTML and JavaScript by updating device values of the Text or Alert subtypes through the API. The mobile dashboard renders this data using `ng-bind-html` with an `nl2br()` transform that fails to perform HTML escaping. This allows malicious payloads to be stored and executed in an administrator's browser when viewing the dashboard, potentially leading to session cookie theft and account takeover.

An authentication bypass exists in the webhook token check of the scheduler-webhook plugin. When the webhook feature is enabled but no `webhookToken` is configured, the system skips token validation. This allows an unauthenticated remote attacker to trigger previously configured scheduled jobs by sending a request to the 'POST /scheduler/webhook' endpoint. The attacker can determine which job runs using the `job` parameter, although they cannot control the job's payload. Remote code execution is only possible if the operator has configured a job that executes shell commands. This issue requires the scheduler-webhook plugin to be installed and the `scheduler.modern.webhook.enabled` setting to be set to true.

The guided report builder in `reports/guided reports.pl` is susceptible to time-based blind SQL injection. The application reads the `order by` CGI parameter and a dynamically-named `{order} ovalue` parameter, concatenating them directly into an SQL ORDER BY clause without validation or an allowlist. This occurs because the resulting string is appended verbatim to the final query in `C4::Reports::Guided` via the `$query .= $orderby;` operation. Staff accounts with `create reports` or `execute reports` permissions can exploit this to access the database, which contains patron personally identifiable information (PII) and staff or LDAP credentials.

The LoRA-GA and CorDA initialization modules call the `torch.load()` function on cache or covariance files specified in the configuration without setting the `weights only=True` parameter. This bypasses the safe-loading wrapper implemented in other parts of the codebase. Since `torch.load()` without `weights only=True` performs full pickle deserialization, an attacker can achieve arbitrary code execution by providing a malicious cache or covariance file, such as one that is shared or downloaded.

The `sanitize sql column()` function in `lib/functions.php` fails to properly sanitize user-supplied ORDER BY column names. The function uses a regular expression that allows letters, digits, underscores, parentheses, and dots, which enables payloads like `SLEEP(5)` to pass unmodified. This sanitized value is concatenated directly into raw SQL ORDER BY clauses via the `sort column` GET parameter in the endpoints 'user log.php', 'utilities.php', 'user domains.php', and 'user group admin.php'. Consequently, any authenticated user can perform time-based blind SQL injection, a technique used to extract information from a database by observing the time it takes for the server to respond to specific queries.

The Comments plugin in Cotonti CMS fails to restrict classes during the deserialization of user-supplied data, leading to a PHP Object Injection. This occurs when the `unserialize()` function is used on base64-decoded input without an `allowed classes` restriction. The issue is present in the following locations: - In `plugins/comments/controllers/actions/CreateAction.php`, the `ci` POST parameter is processed. - In `plugins/comments/controllers/actions/EditAction.php`, the `cb` parameter is processed within the `prepareComeBack()` function. - In `plugins/comments/controllers/actions/DeleteAction.php`, a similar pattern exists but is restricted to administrators. Members with write access to comments can exploit this to instantiate arbitrary classes loaded by the system. For example, using the `MySQL cache` class, an attacker can trigger the ` destruct()->flush()` chain to execute unauthorized `INSERT INTO cot cache` operations. Depending on the available gadget chains in the installation, this could potentially lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on the server.

The user-augmentation resolver `AugmentedUser::get()` in `src/Auth/AugmentedUser.php` contains a case for the `two factor recovery codes` handle that returns raw two-factor recovery codes without access restrictions. Unlike passwords, these codes are not excluded from augmentation and are not included in the Antlers variable guard lists, which typically only protect `config.app.key`. If dynamic template rendering is enabled for a field at the blueprint level, an attacker can use a template like `{{ current user.two factor recovery codes }}` to render the user's recovery codes directly into the HTML response. This allows an attacker who can view or capture the response to obtain the codes and bypass two-factor authentication (2FA). Exploitation depends on dynamic Antlers rendering being enabled via blueprint configuration.

The admin grid sorting helper ` gridGetSorting()` in includes/classes/ia.base.controller.admin.php fails to properly validate the `sort` GET parameter. While the function attempts to whitelist the direction parameter, it falls back to using the raw, attacker-supplied `sort` parameter when the requested key is missing from the `$ gridSorting` whitelist array. This value is then inserted into a SQL query using `sprintf()` with only backtick-quoting and no escaping. An authenticated admin session can use a backtick in the payload to break out of the identifier context and perform SQL injection, such as error-based extraction via `EXTRACTVALUE()` or time-based extraction via `SLEEP()`, to retrieve database contents including administrator password hashes. This issue affects the majority of admin grid controllers, including pages.php, transactions.php, languages.php, and members.php.

Bolt CMS renders content field values using the full Twig application-level Environment without a SandboxExtension. In the `src/Entity/Field.php` file, the `getTwigValue()` function calls `shouldBeRenderedAsTwig()`, which only checks the `allow twig` flag and a regex for `{{`, `{%`, or `{#`. When these conditions are met, the raw field value is compiled and rendered via `self::getTwig()->createTemplate($value)->render(['record' => $this->getContent()])` without sandboxing. Since the default content field for pages in `config/bolt/contenttypes.yaml` has `allow twig` set to true by default, users with edit access to that content type can inject Twig payloads to execute arbitrary OS commands as the web server user, leading to remote code execution.

The reference implementation of the Asynchronous Network Management System (ANMS) contains a configuration issue where the `amp-manager` service REST API is published directly to the host network interface on port 8089. This configuration bypasses the Configuration and Access Manager (CAM) gateway, which serves as the system's only authentication boundary. The underlying REST server, implemented with CivetWeb in `dtnma-tools` (specifically in `src/refdm/nm rest.c`), has the `enable auth domain check` setting disabled and uses a null authentication callback for all routes. This allows any network-reachable client to enumerate registered agents, clear stored reports, and submit arbitrary command sets to agents via the `.../agents/{eid|idx}/send` endpoint, which forwards EXECSET-encoded command sets to registered DTNMA agents.

Authenticated users can bypass server-side request forgery (SSRF) protections by using hexadecimal IP address notation in user-controlled URLs. Through the web link creation feature, attackers can submit hexadecimal-encoded internal IP addresses, leading cURL to connect to internal network resources, including localhost services, cloud instance metadata services, and RFC1918 addresses. This occurs because the `isPrivateURL()` function in `app/Core/Http/Client.php` incorrectly validates the input as safe since `FILTER VALIDATE IP` rejects non-dotted-decimal notation.

The Space Link Extension (SLE) interface manager lacks proper authentication, allowing unauthenticated network attackers to access seven unprotected API routes via direct HTTP requests. This allows attackers to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.

An authentication flaw allows an unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. This is possible by calling the `Sessions.create()` function, which fails to perform credential checks. Once a session is established, an attacker can invoke the `handle cmd()` function to forward arbitrary commands directly to the AIT command bus, as there is no authentication gate between session creation and command dispatch.

Authenticated administrators can execute arbitrary commands as the web server process user by configuring a malicious backup path and triggering a backup. The `FileBackupService` constructs a tar shell command using string concatenation, incorporating the `siteBackupPath` variable without proper sanitization via `escapeshellarg()` or similar methods before passing it to the `exec()` function. This allows injected commands to persist and execute during every subsequent backup operation.

An authentication bypass exists in the scheduler-webhook plugin due to a short-circuit logic flaw during webhook token validation. This allows unauthenticated remote attackers to trigger configured scheduled jobs by sending a POST request to the scheduler webhook endpoint. Attackers can execute all configured jobs or target a specific one, leading to the unintended execution of operator-defined commands under the privileges of the web server process user.

Missing authorization in the Bucket file storage API endpoint '/system/buckets/api' allows authenticated users to bypass access control. The `api()` function in modules/System/Controller/Buckets.php executes commands such as `ls`, `upload`, `removefiles`, `rename`, and `createfolder` without verifying Access Control Lists (ACL) or user roles. Consequently, any authenticated user can perform all bucket operations on any named bucket, including those reserved for administrators.