Uberbrady

A server-side request forgery (SSRF) issue exists in the webhook testing feature. This allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges (private IP address spaces). By pointing webhooks at internal hosts and ports and comparing 4xx versus 5xx responses from the Test Webhooks functionality, an attacker can map active hosts and open ports.

An authenticated superadministrator can execute arbitrary operating system commands as the web application user by uploading a crafted ZIP backup and triggering a restore. The issue occurs because SQL entries from the backup archive are streamed into the MySQL/MariaDB command-line client without the `--binary-mode` flag, causing the client to interpret lines starting with backslash commands, such as `!`, as local shell commands. This can lead to the exposure of application secrets, including database credentials and `APP KEY`, and allow the modification of application-writable files and data. The attack involves the following endpoints: - 'POST /admin/backups/upload' - 'POST /admin/backups/restore/{filename}' The exploitation is possible when the optional `clean` sanitizer parameter is not used, which is the default behavior when `DB SANITIZE BY DEFAULT` is false.

Name of the Vulnerable Software and Affected Versions: snipe-it (affected versions not specified) Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software fails to properly neutralize user input, allowing an attacker to inject malicious code into web pages. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows for XSS in certain use cases, specifically when using Ajax remote data loading and HTML templates to display listbox data. This affects rich selectlists.