Seawind

A Zabbix user with API access can exploit a blind SQL injection in the `CApiService.php` file. The issue resides in the `sortfield` parameter, allowing an attacker to execute arbitrary SQL selects. While query results are not directly returned, data can be exfiltrated using time-based techniques. This could lead to the disclosure of session identifiers and compromise of administrator accounts. The vulnerable component is located at the API endpoint include/classes/api/`CApiService.php`. The vulnerable parameter is `sortfield`.

A vulnerability was found in the system, affecting an unknown functionality of the file /app/action/add staff.php. The manipulation leads to cross site scripting. The attack can be launched remotely.

A critical vulnerability was found in the Admin Panel component of the PHPGurukul Online Shopping Portal, specifically affecting the file /shopping/admin/index.php. The manipulation of the `username` argument leads to SQL injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.