Security Fears Team

Name of the Vulnerable Software and Affected Versions: Hivemaker Professional versions 1.0.2 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands. This is possible when the `magic quotes gpc` setting is disabled. The `cid` parameter is used for this purpose. Recommendations: For Hivemaker Professional versions 1.0.2 and earlier, consider disabling the use of the `cid` parameter in the index.php file until a patch is available. Additionally, enabling `magic quotes gpc` can help mitigate this issue.

Name of the Vulnerable Software and Affected Versions: CMS Buzz (affected versions not specified) Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the `id` parameter in a "playgame" action within the index.php file. Recommendations: For CMS Buzz, consider restricting access to the index.php file or the "playgame" action until a patch is available. As a temporary workaround, avoid using the `id` parameter in the affected action to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** AJ Square AJ HYIP Acme (affected versions not specified) **Description** The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This is possible via the `artid` parameter to two specific API endpoints: "/acme/article/comment.php" and "/prime/article/comment.php". **Recommendations** As a temporary workaround, consider restricting access to the `artid` parameter in the affected API endpoints until a patch is available. Avoid using the `artid` parameter in the "/acme/article/comment.php" and "/prime/article/comment.php" endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.