Yassine Damiri

**Name of the Vulnerable Software and Affected Versions** Puwell IP Camera versions 2.x through 4.x **Description** An authentication bypass exists that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456. By exploiting the unvalidated `Session` field in the proprietary control protocol header, attackers can access live video streams, control pan and tilt motors, activate audio functions, and remotely restart the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Puwell IP Camera versions 2.x through 4.x **Description** An unauthenticated command injection issue exists in the binary protocol service. Remote attackers can execute arbitrary operating system commands with root-level privileges by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. This is possible due to a lack of authentication and insufficient input sanitization, which can lead to complete device compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vitec Flamingo version 4.12.2 **Description** An unauthenticated OS command injection exists due to a double-evaluation flaw in shell argument handling. The 'admin/ajax/ping.php' endpoint processes the `host` POST parameter using the `escapeshellarg()` function before passing it to a system wrapper. However, the wrapper retrieves the decoded value from `argv` and passes it into a second `shell exec()` call without further escaping. This allows remote attackers to execute arbitrary commands with root privileges via passwordless sudo. **Recommendations** Update Vitec Flamingo version 4.12.2 to a patched version. As a temporary workaround, restrict access to the 'admin/ajax/ping.php' endpoint or avoid using the `host` parameter in that endpoint.

**Name of the Vulnerable Software and Affected Versions** Vitec Flamingo version 4.12.2 **Description** An unauthenticated OS command injection exists in the 'admin/ajax/gen graphs.php' endpoint. Remote attackers can execute arbitrary commands with root privileges by providing shell metacharacters through the `start`, `end`, `key`, or `format` HTTP GET parameters. This occurs because the graph generation script fails to sanitize input before passing it to shell commands via the `passthru()` function. The ability to gain root privileges is facilitated by the web server context having passwordless sudo access. **Recommendations** For version 4.12.2, apply the available security patch immediately. As a temporary mitigation, restrict access to the 'admin/ajax/gen graphs.php' endpoint or avoid using the `start`, `end`, `key`, and `format` parameters until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Nginx Proxy Manager versions 2.9.14 through 2.15.1 **Description** An authenticated remote code execution issue exists via OS command injection in the `setupCertbotPlugins()` function located in backend/setup.js. Attackers with `certificates:manage` permissions can execute arbitrary commands by storing a malicious payload in the `dns provider credentials` field. This occurs because the user-controlled `dns provider credentials` value is interpolated directly into a shell command executed via `child process.exec()` without proper sanitization or escaping, leading to command execution upon backend restart. Real-world offensive activities targeting this issue have been identified. **Recommendations** Update Nginx Proxy Manager to a version that includes commit a5db5ed. Restrict access to the `dns provider credentials` field to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** A stored cross-site scripting issue exists in the file upload functionality. The `checkValidFileName()` function fails to restrict the upload of HTML and HTM files. Authenticated attackers can upload files containing arbitrary JavaScript through the image upload or attachment endpoints. When a user accesses the URL of the uploaded file, the embedded JavaScript executes within their browser. **Recommendations** Update to version 12.4.4 or later. As a temporary workaround, restrict the use of the `checkValidFileName()` function or the image upload and attachment endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** A stored cross-site scripting issue exists in the `checkValidHtmlText()` function within Security.php. The function fails to properly sanitize user input because it only detects specific patterns and returns unsanitized strings without output encoding. This allows attackers to inject malicious payloads using alternative syntax, such as img tags with event handlers, which are then stored and executed in the browsers of users who view the affected content. **Recommendations** Update to version 12.4.4. As a temporary workaround, restrict access to the `checkValidHtmlText()` function within Security.php to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** An unauthenticated SQL injection exists in the login functionality. The `login` variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update to version 12.4.4 or later. As a temporary workaround, restrict access to the authentication endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** A ZipSlip path traversal issue exists in the plugin upload functionality. Authenticated attackers with upload permissions can write files outside the intended extraction directory by using ZIP archives containing directory traversal sequences. This unvalidated archive extraction allows for the placement of a PHP webshell in a web-accessible directory, leading to remote code execution with the privileges of the web server process. The issue is located in the 'uploadPlugin.php' endpoint. **Recommendations** Update to version 12.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** Authenticated users with guest-level privileges can retrieve sensitive data belonging to other users, such as password hashes and API keys. This occurs due to missing authorization in the 'objectDetail.php' endpoint, allowing attackers to bypass access controls without ownership or role-based validation to extract administrator credentials and perform privilege escalation. **Recommendations** Update to version 12.4.4. As a temporary workaround, restrict access to the 'objectDetail.php' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** A path traversal issue exists in the log file viewer. Authenticated attackers can inject directory traversal sequences into the `logname` parameter at the 'dynamicDialog.php' endpoint to read arbitrary .log files accessible to the web server process on the filesystem. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder. **Recommendations** Update to version 12.4.4 or later. As a temporary workaround, restrict access to the 'dynamicDialog.php' endpoint or avoid using the `logname` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Yi IOT XY-3820 version 6.0.24.10 **Description** The issue concerns Remote Command Execution via the `cmd listen` function located in the `cmd` binary. **Recommendations** For Yi IOT XY-3820 version 6.0.24.10, as a temporary workaround, consider disabling the `cmd listen` function until a patch is available. Restrict access to the `cmd` binary to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: LSC Smart Connect LSC Indoor PTZ Camera version 7.6.32 Description: The issue concerns a remote code execution (RCE) vulnerability in the `tuya ipc direct connect` function of the `anyka ipc` process. This vulnerability allows for arbitrary code execution through the Wi-Fi configuration process when a specially crafted QR code is presented to the camera. Recommendations: For LSC Smart Connect LSC Indoor PTZ Camera version 7.6.32, as a temporary workaround, consider disabling the `tuya ipc direct connect` function until a patch is available. Restrict access to the Wi-Fi configuration process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.