Tikket1

An insecure deserialization issue, specifically PHP object injection, occurs during the handling of segment filters and custom field properties. Certain code paths deserialize stored values from the database without restricting the PHP classes that can be instantiated, bypassing the safe deserialization helper. An attacker with high privileges or the ability to write to the affected stored data can inject crafted serialized values. When Mautic processes this data during segment evaluation, contact export, or custom field API requests, arbitrary PHP objects are instantiated. Using gadget chains—sequences of existing code fragments that can be leveraged for unintended purposes—within dependencies, this can lead to arbitrary code execution on the server, unauthorized access, modification, or deletion of contact data, and service disruption.

An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks.

The app-store plugin service fails to sanitize the `identifier` variable before concatenating it into file system paths. This allows an attacker to use path traversal sequences, such as `../`, to read, install, or uninstall plugins from arbitrary directories. This issue occurs within the `download()`, `install()`, and `unInstall()` functions in the `plugin/mine-admin/app-store/src/Service/Service.php` file. Furthermore, the `install()` function may execute arbitrary composer commands on the traversed directories. The affected API endpoints include `/admin/plugin/store/install`, `/admin/plugin/store/download`, and `/admin/plugin/store/uninstall`.

Authenticated users can perform server-side request forgery (SSRF) by submitting crafted URLs. This issue occurs within the `fetch url()` function of the `ScenarioImport` class, allowing attackers to make arbitrary HTTP requests. This can be used to probe internal network services, enumerate ports through error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

Three code paths bypass the existing Server-Side Request Forgery (SSRF) protections by using raw `http.Get()` instead of the validated `hostmatcher.NewDialContext()` dialer. This allows an attacker to make requests to internal services, scan internal networks (such as `127.0.0.1`, `10.x`, `172.16-31.x`, and `192.168.x`), and steal cloud metadata from endpoints like `169.254.169.254` (e.g., AWS IMDSv1 credentials or GCP tokens). Additionally, the use of the `file://` scheme in the `Open()` function enables local file read, potentially exposing sensitive files such as `/etc/gitea/app.ini` which may contain database credentials and JWT signing secrets. The issue affects the following components: - The `Open()` function in `modules/uri/uri.go`. - Release asset and PR patch downloads in `services/migrations/gitea uploader.go` and `services/migrations/dump.go`. - The `oauth2UpdateAvatarIfNeed()` function in `routers/web/auth/oauth.go`.

The Guest API 'invoice/update' endpoint lacks an authorization check. This allows an unauthenticated user who possesses an invoice hash to modify the payment gateway of an unpaid invoice by changing the `gateway id` variable to any payment gateway already configured in the system. Invoice hashes may be exposed through email links, referrer headers, or shared URLs. The impact is limited by the `invoice accessible from hash` system setting and the requirement that the gateway must be pre-installed by an administrator.

A SQL injection issue exists in the `Massmailer` module filter functionality. An authenticated administrator can provide crafted filter values during the update of a mass email message, which allows untrusted input to be interpolated directly into the SQL recipient selection query.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Server and project lookups are not scoped to the current team, which allows any authenticated user to access servers and projects belonging to other teams by specifying their IDs directly.

Name of the Vulnerable Software and Affected Versions Hi.Events versions 0.8.0-beta.1 through 1.7.1-beta Description Hi.Events is an open-source event management and ticket selling platform. Multiple repository classes pass the user-supplied `sort by` query parameter directly to Eloquent's `orderBy()` without validation, enabling SQL injection. The application uses PostgreSQL which supports stacked queries. Recommendations Update to version 1.7.1-beta or later.