Yinfei6

A password vulnerability allows a remote attacker to execute arbitrary code via the `password` parameter at the "/goform/sysTools" and "/adm/systools.asp" endpoints. This issue has been identified in scans probing for vulnerable routers.

A command execution issue was discovered in the device.

The issue allows for code execution.

A command execution issue was found. This allows for the execution of commands, potentially leading to unauthorized access or control.

A SQL Injection issue allows attackers to execute arbitrary code via the "/admin.php?controller=admin commonuser" API endpoint, specifically through the `controller` parameter. This enables attackers to potentially gain unauthorized access and manipulate data.

The issue is related to SQL Injection. In the sys sql n query.php file, there are no restrictions on the SQL query, which can be exploited.

The issue is related to incorrect access control, allowing an attacker to bypass permissions and gain super administrator privileges in the background of the firewall. This is due to a configuration error in the report module.

The issue is related to a privilege bypass.

A CSRF issue allows adding an admin account via the index or the "/admin.php/Admin/adminadd.html" API endpoint.

The issue allows for Arbitrary file deletion via the "file manage control.php" endpoint.

The issue is related to SQL Injection. It affects the sys sql query.php file.

The issue allows for Remote Code Execution (RCE) via the `file manage control.php` endpoint.

The issue concerns SQL Injection via the `username` variable. However, it is noted that this vulnerability is disputed by multiple third parties because Boa does not ship with any support for SQL.