Headline
CVE-2023-33558: GitHub - ninj4c0d3r/OcoMon-Research
An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e-mails and usernames.
OcoMon Research****OcoMon < 4.0RC1 - Account Takeover [CVE-2022-40798]
Through password recovery its possible to obtain a token to reset password of any user.
OcoMon < 4.0.1 - User enumeration [CVE-2023-33558]
The vulnerability allows the attacker to obtain information such as Email, Username of the OcoMon users.
OcoMon < 4.0.1 - File Inclusion allow Remote Code Execution [CVE-2023-33559]
The vulnerability allows an authenticated user to change the language setting by passing a valid file path, the code will include the file and in some environments will execute malicious code.
Fix
https://ocomonphp.sourceforge.io/downloads/
Related news
A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file.
OcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request with correct email its possible to account takeover.