Snkn0W

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.

**Name of the Vulnerable Software and Affected Versions** R2R versions prior to 3.6.7 **Description** Unauthenticated attackers can perform time-based and boolean-based data exfiltration from the application database. This is possible due to the direct interpolation of filter keys into the SQL WHERE clause without parameterization or escaping, allowing the injection of SQL predicates into the chunks search query via the retrieval search endpoint using the `filter key` parameter. **Recommendations** Update R2R to version 3.6.7 or later. As a temporary workaround, restrict access to the retrieval search endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** kalcaddle kodbox versions up to 1.64.05 **Description** A flaw exists in kalcaddle kodbox that allows for operating system command injection. This occurs through manipulation of the `localFile` argument within the `run` function of the `plugins/fileThumb/lib/VideoResize.class.php` file, part of the Media File Preview Plugin component. The attack can be carried out remotely. The exploit for this issue has been publicly disclosed. The vendor was informed of the disclosure but did not provide a response. **Recommendations** Versions prior to 1.64.05 should be updated. As a temporary workaround, consider restricting access to the `plugins/fileThumb/lib/VideoResize.class.php` file.

**Name of the Vulnerable Software and Affected Versions** kalcaddle kodbox versions up to 1.61.10 **Description** A command injection issue exists in kalcaddle kodbox. The issue is related to the processing of the file `/explorer/index/zip` within the Compression Handler component. Successful exploitation may allow for remote command execution. The exploit is publicly available. **Recommendations** Versions prior to 1.61.10 are vulnerable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.