#php

### Summary An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. ### Details Permissions do not seem to be enforced when reaching the `admin/ecommerceframework/admin-order/list` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. It seems that the access control is not enforced in this place : <https://github.com/pimcore/ecommerce-framework-bundle/blob/ff6ff287b6eb468bb940909c56970363596e5c21/src/Controller/AdminOrderController.php#L98> __Note__ : Testing this vulnerability requires a fully configured ecommerce website, but it looks vulnerable as when requesting the endpoint the data seem returned (and when looking at the source code nothing seems to validate the permissions on the specified endpoint). ### PoC In order to reproduce the issue, the following steps can be followed : 1. As an administrator : a. Create a role without an...

liveSite version 2019.1 suffers from a remote code execution vulnerability.

### Summary As of `fonttools>=4.28.2` the subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. ### PoC The vulnerability can be reproduced following the bellow steps on a unix based system. 1. Build a OT-SVG font which includes a external entity in the SVG table which resolves a local file. In our testing we utilised `/etc/passwd` for our POC file to include and modified an existing subset integration test to build the POC font - see bellow. ```python from string import ascii_letters from fontTools.fontBuilder import FontBuilder from fontTools.pens.ttGlyphPen import TTGlyphPen from fontTools.ttLib import newTable XXE_SVG = """\ <?xml version="1.0"?> <!DOCTYPE svg [<!ENTITY test SYSTEM 'file...

PluXml Blog version 5.8.9 suffers from a remote code execution vulnerability.

Form Tools version 3.1.1 suffers from a cross site scripting vulnerability.

As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the default configuration is used. Developers must be aware of that fact and use extension whitelisting accompanied by forcing the server to always provide content-type based on the file extension. The README has been updated to include these guidelines.

WebCalendar version 1.3.0 suffers from reflective and persistent cross site scripting vulnerabilities.

By Owais Sultan Imgly SDK has been a popular choice for developers seeking reliable image processing and manipulation solutions. However, in… This is a post from HackRead.com Read the original post: Exploring Imgly SDK Alternatives for Ultimate Flexibility

Lot Reservation Management System version 1.0 suffers from a remote shell upload vulnerability.

Lot Reservation Management System version 1.0 suffers from a file disclosure vulnerability.