PHP: уязвимости стека · Страница 118

Improper Authorization in Reporting API

This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. * Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the "Reporting Permissions > View Own" and "Reporting Permissions > View Others" permissions, which should restrict access to non-System Reports.

• Обновитесь до 5.2.3

Relative Path Traversal in assets file upload

This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.

• Обновитесь до 5.2.3

SQL injection risk in course search module list filter

An SQL injection risk was identified in the module list filter within course search.

• Обновитесь до 4.1.16
• Обновитесь до 4.3.10
• Обновитесь до 4.4.6
• Обновитесь до 4.5.2

Teachers can evade trusttext config when restoring glossary entries

Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.

• Обновитесь до 4.1.16
• Обновитесь до 4.3.10
• Обновитесь до 4.4.6
• Обновитесь до 4.5.2

IDOR in badges allows disabling of arbitrary badges

Insufficient capability checks made it possible to disable badges a user does not have permission to access.

• Обновитесь до 4.1.16
• Обновитесь до 4.3.10
• Обновитесь до 4.4.6
• Обновитесь до 4.5.2

Reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

• Обновитесь до 4.3.10
• Обновитесь до 4.4.6
• Обновитесь до 4.5.2

Stored XSS risk in admin live log

Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.

• Обновитесь до 4.1.16
• Обновитесь до 4.3.10
• Обновитесь до 4.4.6
• Обновитесь до 4.5.2

Stored XSS in ddimageortext question type

The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.

• Обновитесь до 4.1.16
• Обновитесь до 4.3.10
• Обновитесь до 4.4.6
• Обновитесь до 4.5.2

Non-searchable tags can still be discovered on the tag search page and in the tags block

Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.

• Обновитесь до 4.1.16
• Обновитесь до 4.3.10
• Обновитесь до 4.4.6
• Обновитесь до 4.5.2

Feedback response viewing and deletions did not respect Separate Groups mode

Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.

• Обновитесь до 4.1.16
• Обновитесь до 4.3.10
• Обновитесь до 4.4.6
• Обновитесь до 4.5.2

Arbitrary file read risk through pdfTeX

Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).

• Обновитесь до 4.1.16
• Обновитесь до 4.3.10
• Обновитесь до 4.4.6
• Обновитесь до 4.5.2

Leantime allows Cross-Site Scripting (XSS)

### Summary There is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do.

• Обновитесь до 3.3

Leantime has Missing Authorization Check for Host Parameter

### Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. ### Impact By exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything)

• Обновитесь до 3.3

Leantime allows Stored Cross-Site Scripting (XSS)

### Description Leantime allows stored cross-site scripting (XSS) in the API key name while generating the API key. ### Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.

• Обновитесь до 3.3

Leantime allows Cross-Site Request Forgery (CSRF)

**CSRF** ### Summary A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing. ### Impact While the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.

• Обновитесь до 3.1.2

Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)

### Summary A cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not include any validation or sanitization of the $_GET["id"] parameter. As a result, it directly incorporates the user-supplied value into the source path without any checks.

• Обновитесь до 3.3

Leantime allows Stored Cross-Site Scripting (XSS)

### Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. ### Details A Stored Cross-Site Scripting (XSS) vulnerability was found that could potentially compromise user data and pose a significant security risk to the platform. ### PoC - Create a project - Navigate to project - Visit to the integration - Add malicious payload inside the webhook and save it. - Notice the alert dialogue indicating successful execution of the XSS payload. ``` '';!--" onfocus=alert(0) autofocus="" onload=alert(3);="&{(alert(1))}" |="" mu

Leantime allows Refelected Cross-Site Scripting (XSS)

### Summary The vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation and output encoding in the file upload process can prevent this exploit. Accessing and enhancing the relevant source code modules is crucial for addressing this security flaw effectively. ### Impact This XSS vulnerability allows attackers to inject malicious scripts into the Leantime application, compromising user data, session tokens, and poten

• Обновитесь до 3.3

Leantime has Insufficiently Protected Credentials

Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore. Additional Information: 1.The issue was identified during routine security testing. 2.This vulnerability poses a significant risk to user privacy and data security. 3.Urgent action is recommended to mitigate this vulnerability and protect user data from unauthorized access.

• Обновитесь до 3.3

Leantime allows Stored Cross-Site Scripting (XSS)

STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3

• Обновитесь до 3.3