#sql

Lodging Reservation Management System version 1.0 suffers from an ignored default credential vulnerability.

Login System Project version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

Loan Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

Jobs Finder System version 1.0 suffers from a cross site scripting vulnerability.

Human Resource Management System version 2024 version 1.0 suffers from a cross site scripting vulnerability.

Employee Record Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

DETS Project version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

School Log Management System version 1.0 appears to suffers from a remote SQL injection vulnerability that allows an attacker to achieve code execution.

Simple College Website version 1.0 appears to suffers from a remote SQL injection vulnerability that allows an attacker to achieve code execution.

### Summary In Froxlor 2.1.9 and in the HEADs of the `main`, `v2.2` and `v2.1` branches , the XML templates in `lib/configfiles/` set `chmod 644` for `/etc/pure-ftpd/db/mysql.conf`, although that file contains `<SQL_UNPRIVILEGED_PASSWORD>`. At least on Debian 12, all parent directories of `/etc/pure-ftpd/db/mysql.conf` are world readable by default, thus exposing these credentials to all users with access to the system. Only Froxlor instances configured to use pure-ftpd are affected/vulnerable. ### Details https://github.com/froxlor/Froxlor/blob/2.1.9/lib/configfiles/bookworm.xml#L3075 ### PoC As non-privileged user: ``` nobody@mail:/tmp$ grep MYSQLPassword /etc/pure-ftpd/db/mysql.conf MYSQLPassword MySecretMySQLPasswordForFroxlor ``` ### Impact Any unprivileged user with "command/code execution" access to the system can trivially obtain the credentials granting access to the `froxlor` MySQL database. This holds true even for virtual users without SSH access as long as they are a...