Yagiz-Dev

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions 0.5.4 through 0.7.2 **Description** The `/run-patcher` endpoint is accessible without authentication, allowing remote users to trigger privileged maintenance operations. These operations include configuration migrations, database schema changes (such as `ALTER TABLE`, `DROP TABLE`, and `UPDATE` statements), filesystem mutations (deletions and renames), and cache clearing. The endpoint lacks administrator authentication, CSRF validation, and CLI context requirements. An attacker can trigger these routines via an HTTP GET request to the `/run-patcher` endpoint, which may lead to denial-of-service attacks, session invalidation, or an inconsistent database state due to repeated or concurrent requests.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions prior to 0.8.0 **Description** FOSSBilling leaks the exact system version through asset cache buster parameters in HTML output, which bypasses the `hide version public` security setting. The version is embedded in the query string of every `<script>` and `<link>` tag generated by the `script tag` and `stylesheet tag` Twig filters. This information is visible to all visitors, including unauthenticated guests, on every page. While the `X-FOSSBilling-Version` HTTP header and the `guest.system.version` API endpoint correctly honor the security setting, the asset cache buster parameters do not. This exposure facilitates reconnaissance by allowing actors to identify known issues applicable to a specific installation. **Recommendations** Update to version 0.8.0.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions prior to 0.8.0 **Description** Authenticated sessions for client, staff, or admin accounts are not invalidated when the account is suspended or marked inactive. The session identity loaders in `src/di.php` (`loggedin client` and `loggedin admin`) only reject sessions if the account record is completely removed from the database, failing to verify if the account status is active. This allows deactivated users to maintain full access until the session expires naturally. **Recommendations** Update to version 0.8.0.