Topsec_Lizhongcheng

**Name of the Vulnerable Software and Affected Versions** OTCMS version 3.81 **Description** The issue allows for XSS via the `mode` parameter in an "apiRun.php?mudi=autoRun" request. **Recommendations** For OTCMS version 3.81, avoid using the `mode` parameter in the "apiRun.php?mudi=autoRun" request until the issue is resolved. Consider restricting access to this API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Gila CMS version 1.10.1 **Description** The issue allows for absolute path traversal, enabling the reading of arbitrary files. This is possible through the `admin/db backup?download=` endpoint in the `core/classes/db backup.php` file. The `download` parameter is vulnerable to manipulation, allowing an attacker to access files outside the intended directory. **Recommendations** For Gila CMS version 1.10.1, consider restricting access to the `admin/db backup` endpoint until a patch is available. As a temporary workaround, avoid using the `download` parameter in the `admin/db backup?download=` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gila CMS version 1.10.1 **Description** The issue allows for Cross-Site Request Forgery (CSRF) in the `fm/save` endpoint, potentially leading to the execution of arbitrary PHP code. **Recommendations** For Gila CMS version 1.10.1, update to a version that includes a fix for this issue, as using the `fm/save` endpoint can lead to arbitrary PHP code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MKCMS version 5.0 **Description** The issue allows remote attackers to take control of arbitrary user accounts. This is achieved by posting a `username` and an `e-mail address` to the "ucenter/repass.php" endpoint, which then triggers the transmission of the password via e-mail. **Recommendations** For MKCMS version 5.0, as a temporary workaround, consider disabling the password recovery function in "ucenter/repass.php" until a patch is available. Restrict access to the "ucenter/repass.php" endpoint to minimize the risk of exploitation. Avoid using the `username` and `e-mail address` parameters in the affected endpoint until the issue is resolved.