Valentin Holubec

Cross-site request forgery occurs when the application merges `$ GET` and `$ POST` parameters without requiring an anti-CSRF token. This allows remote attackers to forge privileged actions, such as the creation of administrator users, by crafting malicious links or auto-navigating pages that issue plain GET requests. This exploitation leverages the lack of CSRF protection and SameSite=Lax cookie behavior during top-level navigations.

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.

Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.

Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization.

Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure.

An issue exists where password-reset tokens are generated using a predictable method, specifically as `sha1(login.password)`. Because this value is deterministic and reusable, unauthenticated attackers can compute or brute-force the token using known or guessed login and password combinations. This allows the creation of forged password-reset requests to hijack arbitrary user accounts.

The software stores the persistent remember-me token verbatim on the server side, which makes the stored value identical to the bearer credential held in the user's cookie. An attacker who obtains the stored token, for example through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without requiring a password.

A session fixation issue exists where the application fails to regenerate the session identifier after a user successfully authenticates. This allows a remote attacker to hijack an authenticated session by planting a known session identifier in a victim's browser before they log in.

A path traversal flaw exists that allows attackers to write arbitrary files outside the intended temporary directory. This occurs when an unanchored `tmpFolderName` value is supplied in the upload destination path. By using a traversal sequence targeting the web root via the `tmpFolderName` variable, an attacker can write controlled files to the system and achieve remote code execution.

Broken access control in the 'MobileFileDownload' route allows unauthenticated attackers to download arbitrary files. The system fails to perform proper authorization checks, instead relying on an `md5(filename)` token. Attackers who can guess or determine file names can generate the required token to retrieve protected files, resulting in unauthorized information disclosure.

A SQL injection issue exists in the calendar functionality. An attacker can inject malicious SQL by manipulating the `sortEvents` parameter, which is concatenated into the ORDER BY clause without sanitization in the `app/ModCalendar/CtrlCalendar.php` file. This flaw can be exploited using error-based techniques, such as extractvalue payloads, to retrieve database information, including version data, from the system.

Broken access control allows a non-administrative member to create user accounts by invoking the user-edit action. This occurs because the `actionVueEditUser` function lacks a function-level authorization check, specifically missing the enforcement of `editRight()`, which can lead to privilege escalation.

Broken access control allows a space administrator to assign users to spaces outside their authority. This occurs because the `spaceAffectList` affectation is performed without verifying the caller's rights to the target space. Specifically, a missing `readRight()` check in the import flow's join INSERT allows attackers to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

A reflected cross-site scripting issue allows unauthenticated attackers to inject malicious HTML attributes. This occurs because the `visioUrl` parameter is not routed through the URL-sanitizing branch of the parameter filter and is urldecoded after filtering. An attacker can craft a malicious URL containing the `visioUrl` parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser before authentication.

Authenticated users can perform a stored cross-site scripting attack by submitting an unsanitized `adress` field. This input is echoed into an onclick event-handler attribute without neutralizing quotes, allowing malicious scripts to be stored via the Links module. When other users view the links list, the payload executes in their browser, which can lead to session hijacking or client-side compromise.

Authenticated attackers can persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow. This occurs because the `paramsFilter()` function fails to recurse into nested arrays, allowing the request parameter filter to be bypassed. Consequently, arbitrary script code can be injected into a user profile and executed in the browsers of other users who view that profile. Stored cross-site scripting is a flaw where malicious scripts are permanently stored on the target server.

A stored cross-site scripting issue exists that allows authenticated users to post messages containing attacker-controlled iframes via the messenger's HTMLPurifier SafeIframe branch. This allows attackers to send malicious iframes that are stored and automatically rendered for other channel members, facilitating zero-click drive-by downloads and framed JavaScript execution in the browsers of recipients.