Snaacky

**Name of the Vulnerable Software and Affected Versions** GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449 **Description** A SQL injection issue exists in the tags manager. Remote authenticated users with `users mod` privileges can execute arbitrary SQL commands by sending a crafted POST request to the 'tools.php?action=manage tags' endpoint using the `tagid` or `type` parameters. **Recommendations** Update GazellePW (GazellePosterWall) to a version including commit 86c4bedf727691b5a97af42a4864869d18446449 or later. As a temporary mitigation, restrict access to the 'tools.php?action=manage tags' endpoint or avoid using the `tagid` and `type` parameters until the update is applied.

**Name of the Vulnerable Software and Affected Versions** GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449 **Description** An issue exists in the country-code lookup endpoint that allows remote authenticated users with `users view ips` privileges to execute arbitrary SQL commands. This is achieved by sending a crafted request to the 'tools.php?action=get cc' endpoint using the `ip` parameter. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update GazellePW (GazellePosterWall) to commit 86c4bedf727691b5a97af42a4864869d18446449 or later. As a temporary mitigation, restrict access to the 'tools.php?action=get cc' endpoint or avoid using the `ip` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449 **Description** A Stored Cross-Site Scripting (XSS) issue exists in the donor avatar mouse-over text feature. Remote authenticated users can inject arbitrary JavaScript through the `avatar mouse over text` parameter. This malicious script is stored on the server and subsequently executed when the avatar tooltip is rendered for other users. **Recommendations** Update GazellePW (GazellePosterWall) to commit 86c4bedf727691b5a97af42a4864869d18446449 or a newer version. As a temporary mitigation, restrict the use of the `avatar mouse over text` parameter.

**Name of the Vulnerable Software and Affected Versions** GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449 **Description** A Stored Cross-Site Scripting (XSS) issue exists in the torrent remaster custom title feature. Remote authenticated users can inject arbitrary JavaScript through the `remaster custom title` parameter. This script is stored during the torrent upload or edit process and is subsequently executed when the torrent title is rendered in the output. **Recommendations** Update GazellePW (GazellePosterWall) to commit 86c4bedf727691b5a97af42a4864869d18446449 or a newer version. As a temporary mitigation, restrict the use of the `remaster custom title` parameter during torrent upload and editing.

**Name of the Vulnerable Software and Affected Versions** GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449 **Description** A Stored Cross-Site Scripting (XSS) issue exists in the custom bonus title feature. This allows remote authenticated users to inject arbitrary JavaScript through the `title` parameter in the '/bonus.php' and '/user.php?action=staff tool' endpoints. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way. **Recommendations** Update GazellePW (GazellePosterWall) to a version including commit 86c4bedf727691b5a97af42a4864869d18446449 or later. As a temporary mitigation, restrict access to the '/bonus.php' and '/user.php?action=staff tool' endpoints or avoid using the `title` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** GazellePW (GazellePosterWall) (affected versions not specified) **Description** Broken access control in the API user endpoint allows authenticated users without elevated privileges to enable or disable any user account. This is achieved by sending a request to the endpoint using a standard user-created API token with the `req` parameter set to either `disable` or `enable`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449 **Description** A Stored Cross-Site Scripting (XSS) issue exists in the subtitle deletion flow. Remote authenticated users can inject arbitrary JavaScript through a specially crafted subtitle filename. This malicious script is stored during the upload process and subsequently executed when rendered at the '/subtitles.php?action=delete' endpoint. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way. **Recommendations** Update GazellePW (GazellePosterWall) to commit 86c4bedf727691b5a97af42a4864869d18446449 or a newer version.