deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-gq3g-666w-7h85
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav Exposes Password Hashes Leading to privilege escalation

Details:
# Exposure of Password Hashes Leading to privilege escalation
**Severity Rating:** Medium 

**Vector:** Privilege Escalation

**CVE:** XXX

**CWE:** 200 - Exposure of Sensitive Information

**CVSS Score:** 6.2

**CVSS Vector:** CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

## Analysis

It was observed that if a users is given read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes.

An attacker with read access can: 
* View and potentially crack the password hashes.
* Gain administrative access by cracking the admin password hash.
* Escalate privileges and compromise the entire admin panel.


## Proof of Concept

1) Give read access to user accounts to a random user as shown in the following figures:
  ![grav0](https://github.com/user-attachments/assets/020a4b47-e577-49cb-8392-bfb61491199d)
  ![grav2](https://github.com/user-attachments/assets/97fbfc46-c541-4559-9541-2b9b5de86c0e)
  

2) Log in to the admin panel with an account that has read access to user accounts and navigate to the user account management section.

3) Go to the admin profile `http://127.0.0.1/admin/accounts/users/admin`; The password is not display. Try inspecting the page source code as shown in the following figures:
  ![grav2-1](https://github.com/user-attachments/assets/057c9c14-f928-4584-99ae-4939f63dda57)
  
   You can see that it match the hash that is in the admin.yaml file :
  ![Compare to the hash in database of the admin](grav2-2.png)
  

4) Crack the hash as shown in the following figure, the algorithm use here is bcrypt:
  
![grav3](https://github.com/user-attachments/assets/ec334f80-4b87-4010-a834-cb92704a596e)
  

## Workarounds
No workaround is currently known

# Timeline
**2024-07-24** Issue identified

**2024-09-27** Vendor contacted


# About X41 D-Sec GmbH
X41 is an expert provider for application security services.
Having extensive industry experience and expertise in the area of information
security, a strong core security team of world class security experts enables
X41 to perform premium security services.

Fields of expertise in the area of application security are security centered
code reviews, binary reverse engineering and vulnerability discovery.
Custom research and IT security consulting and support services are core
competencies of X41.
GitHub Security Advisory: GHSA-x62q-p736-3997
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav is vulnerable to a DOS on the admin panel

Details:
# DOS on the admin panel
**Severity Rating:** Medium 

**Vector:** Denial Of Service

**CVE:** XXX

**CWE:** 400 - Uncontrolled Resource Consumption

**CVSS Score:** 4.9

**CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

## Analysis

A Denial of Service (DoS) vulnerability has been identified in the application related to the handling of `scheduled_at` parameters. Specifically, the application fails to properly sanitize input for cron expressions. By manipulating the `scheduled_at` parameter with a malicious input, such as a single quote, the application admin panel becomes non-functional, causing significant disruptions to administrative operations.

The only way to recover from this issue is to manually access the host server and modify the `backup.yaml` file to correct the corrupted cron expression

## Proof of Concept

1) Change the value of `scheduled_at` parameter to `'` as shown in the following figures at the `http://127.0.0.1/admin/tools` endpoint, and observe the response in the second figure:
  ![gravdos2](https://github.com/user-attachments/assets/b2d8935f-c8ba-4eda-998a-8a20b3d5ef7c)
  *Figure: Http request on tool endpoint*
![gravdos3](https://github.com/user-attachments/assets/2a283254-316a-45b3-a5ac-6804e2494cd7)
  *Figure: Http response on tool endpoint*

2) When trying to access the admin panel, the panel is broken as shown in the following figure. Additionally, the value change is reflected in the `backup.yaml` file, as shown in the second figure:
  ![gravdos4](https://github.com/user-attachments/assets/1257adcb-96c4-4b30-864e-9aa01e410ded)
  *Figure: Error message view*
![gravdos5](https://github.com/user-attachments/assets/4cef7c49-6a1e-4414-8332-3195aa2dfc77)
  *Figure: Backup.yaml file*


## Workarounds
No workaround is currently known

# Timeline
**2024-07-24** Issue identified

**2024-09-27** Vendor contacted


# About X41 D-Sec GmbH
X41 is an expert provider for application security services.
Having extensive industry experience and expertise in the area of information
security, a strong core security team of world class security experts enables
X41 to perform premium security services.

Fields of expertise in the area of application security are security centered
code reviews, binary reverse engineering and vulnerability discovery.
Custom research and IT security consulting and support services are core
competencies of X41.
GitHub Security Advisory: GHSA-v8x2-fjv7-8hjh
Package: getgrav/grav (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

Details:
### Summary
Due to a broken access control vulnerability in the `/admin/pages/{page_name}` endpoint, an editor ( user with full permissions to pages ) can change the functionality of a form after submission.

### Details
Due to improper authorization checks when modifying critical fields on a POST request to `/admin/pages/{page_name}`, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the `data[_json][header][form]` which is the YAML frontmatter which includes the `process` section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities.

### PoC

- Have Admin and Form plugins installed
- Connect to panel as admin, create user and give him permission for pages all
- Now connect as that user and notice you cant edit any process field in the panel
- Change anything in the content of the form and save
- Intercept the request:
![image](https://github.com/user-attachments/assets/a66767d9-648e-45b5-9031-4a15bee3072a)

- Now modify the field `data[_json][header][form] with the following payload URL-encoded not like this:
```
{"name":"ssti-test 2","fields":{"name":{"type":"text","label":"Name","required":true}},"buttons":{"submit":{"type":"submit","value":"Submit"}},"process":[{"message":"{{ evaluate_twig(form.value('name')) }}"}]}
```

- Change the field and forward it:
![image](https://github.com/user-attachments/assets/dd5f95d7-c61f-4fc0-9e9a-e67825f20aea)

Request goes through and changes have been made to the form.
![image](https://github.com/user-attachments/assets/42a77e10-571b-43a2-8410-14d82dba28e5)

### Impact

- Attacker can modify submission logic of the form which leads to changing redirect value, email sending, changing template, breaking out of the Twig sandbox potentially executing code...

### Fix recommendation

- Implement proper authorization checks to such requests especially when it contains fields user shouldn't be able to modify based on his role.
GitHub Security Advisory: GHSA-p4ww-mcp9-j6f2
Package: getgrav/grav (COMPOSER)
Severity: HIGH (CVSS 8.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav is vulnerable to Arbitrary File Read

Details:
### Summary

- A low privilege user account with page editing privilege can read any server files using "Frontmatter" form.
- This includes Grav user account files - /grav/user/accounts/*.yaml. This file stores hashed user password, 2FA secret, and the password reset token.
- This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password.

### Details
_The vulnerability can be found in /user/plugins/form/templates/forms/fields/display/display.html.twig_
![image](https://github.com/getgrav/grav/assets/28057767/953dbdf1-310f-4c8e-866c-8470d70cc11d)


### PoC
1.	This PoC was conducted on Grav CMS version 1.7.46 and Admin Plugin version 1.10.46
 
![image](https://github.com/getgrav/grav/assets/28057767/6c8607d6-cea3-4699-8a5a-8a04d047676f)

2.	go to “http://grav.local/admin/pages” then create new page with “Page Template” option set to “Form”.
 
![image](https://github.com/getgrav/grav/assets/28057767/451fe8bc-2e2e-4f8a-a548-385aca6d5504)

3.	Then go to “Expert” and on Frontmatter input box used to following form template.

![image](https://github.com/getgrav/grav/assets/28057767/9e44758a-021a-45fd-9e26-03abbf8095ef)

4.	Save page and go the preview or published page you will see the content of “/etc/passwd” file on the server.
 
![image](https://github.com/getgrav/grav/assets/28057767/94dc2363-10e1-4e74-81e4-6c7a09db4dff)



### Impact
This can allow a low privileged user to perform a full account takeover of other registered users including Administrators. This can also allow an adversary to read any file on the web server. And Due to insufficient permission verification , user who can write a page also can use frontmatter feature using this IDOR vulnerability [PoC IDOR](https://www.youtube.com/watch?v=EU1QA0idoWE&ab_channel=%EA%B9%80%EC%A2%85%EB%AF%BC) mention in [CVE-2024-2792](https://github.com/getgrav/grav/security/advisories/GHSA-f6g2-h7qv-3m5v)
GitHub Security Advisory: GHSA-cjcp-qxvg-4rjm
Package: getgrav/grav (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Details:
### Summary
A privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users.
A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access.


### Steps to Reproduce
1. Make sure you have two accounts: an admin and a user with create user privilege
2. In the user account, navigate to /grav-admin/admin/accounts/users and click "Add"
3. Enter the name of the admin, complete registration and observe that the existing admin’s email is changed to the value you provided.
4. Log out from user account log in as admin with new credentials


### Impact
1. Full admin takeover by any user with create user permission.
2. Ability to change admin credentials, install/remove plugins, read or modify site data, and execute any action available to an admin.
3. Severity: High/Critical.


### PoC
https://github.com/user-attachments/assets/3ab0a7d6-5055-41be-9e0e-2bd6ca359b37
GitHub Security Advisory: GHSA-vqc7-7fj4-3fm3
Package: redaxo/source (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.20.1
Patched in: 5.20.1

Summary: REDAXO CMS is vulnerable to XSS through its module management component

Details:
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.
GitHub Security Advisory: GHSA-xj9j-gjxg-7jvq
Package: redaxo/source (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 5.20.1
Patched in: 5.20.1

Summary: REDAXO CMS is vulnerable to RCE attack through its template management component

Details:
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.
GitHub Security Advisory: GHSA-x6vr-q3vf-vqgq
Package: redaxo/source (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.20.1
Patched in: 5.20.1

Summary: REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

Details:
### Summary
A reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter `args[types]` is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in.

### Details

Control Flow:

1. `redaxo/src/addons/mediapool/pages/index.php` reads args via `rex_request('args', 'array')` and passes them through as `$argUrl` to `media.list.php`.
2. `redaxo/src/addons/mediapool/pages/media.list.php` injects `$argUrl['args']['types']` into an HTML string without escaping:

```
if (!empty($argUrl['args']['types'])) {
    echo rex_view::info(rex_i18n::msg('pool_file_filter') . ' <code>' . $argUrl['args']['types'] . '</code>');
}
```

### PoC

1. Log into the REDAXO backend.
2. While authenticated, open a crafted URL like: `<host>/index.php?page=mediapool/media&args[types]="><img+src%3Dx+onerror%3Dalert%28document.domain%29>`
4. The info banner displays the unescaped value and activates the injected onerror handler, which opens an alert pop-up.

### Impact
Arbitrary JavaScript execution in the backend, enabling theft of session cookies, CSRF tokens, or other sensitive data, and allowing an attacker to perform any administrative actions on behalf of the affected user.
GitHub Security Advisory: GHSA-68q5-78xp-cwwc
Package: contao/core-bundle (COMPOSER)
Severity: LOW (CVSS 3.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-87: Improper Neutralization of Alternate XSS Syntax
Vulnerable versions: >= 5.4.0-RC1, < 5.6.5
Patched in: 5.6.5

Summary: Contao is vulnerable to cross-site scripting in templates

Details:
### Impact

It is possible to inject code into the template output that will be executed in the browser in the front end and back end.

### Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5.

### Workarounds

Do not use the affected templates or patch them manually.

### Refsources

https://contao.org/en/security-advisories/cross-site-scripting-in-templates
GitHub Security Advisory: GHSA-68q5-78xp-cwwc
Package: contao/core-bundle (COMPOSER)
Severity: LOW (CVSS 3.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-87: Improper Neutralization of Alternate XSS Syntax
Vulnerable versions: >= 5.0.0-RC1, < 5.3.42
Patched in: 5.3.42

Summary: Contao is vulnerable to cross-site scripting in templates

Details:
### Impact

It is possible to inject code into the template output that will be executed in the browser in the front end and back end.

### Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5.

### Workarounds

Do not use the affected templates or patch them manually.

### Refsources

https://contao.org/en/security-advisories/cross-site-scripting-in-templates
GitHub Security Advisory: GHSA-68q5-78xp-cwwc
Package: contao/core-bundle (COMPOSER)
Severity: LOW (CVSS 3.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-87: Improper Neutralization of Alternate XSS Syntax
Vulnerable versions: >= 4.0.0, < 4.13.57
Patched in: 4.13.57

Summary: Contao is vulnerable to cross-site scripting in templates

Details:
### Impact

It is possible to inject code into the template output that will be executed in the browser in the front end and back end.

### Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5.

### Workarounds

Do not use the affected templates or patch them manually.

### Refsources

https://contao.org/en/security-advisories/cross-site-scripting-in-templates
GitHub Security Advisory: GHSA-98vj-mm79-v77r
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 6.6)
CWE: CWE-351: Insufficient Type Distinction
Vulnerable versions: >= 5.4.0-RC1, < 5.6.5
Patched in: 5.6.5

Summary: Contao is vulnerable to remote code execution in template closures

Details:
### Impact

Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.

### Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5

### Workarounds

Manually patch the `Contao\Template::once()` method.

### Resources

https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
GitHub Security Advisory: GHSA-98vj-mm79-v77r
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 6.6)
CWE: CWE-351: Insufficient Type Distinction
Vulnerable versions: >= 5.0.0-RC1, < 5.3.42
Patched in: 5.3.42

Summary: Contao is vulnerable to remote code execution in template closures

Details:
### Impact

Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.

### Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5

### Workarounds

Manually patch the `Contao\Template::once()` method.

### Resources

https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
GitHub Security Advisory: GHSA-98vj-mm79-v77r
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 6.6)
CWE: CWE-351: Insufficient Type Distinction
Vulnerable versions: >= 4.0.0, < 4.13.57
Patched in: 4.13.57

Summary: Contao is vulnerable to remote code execution in template closures

Details:
### Impact

Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.

### Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5

### Workarounds

Manually patch the `Contao\Template::once()` method.

### Resources

https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
GitHub Security Advisory: GHSA-7j46-f57w-76pj
Package: getformwork/formwork (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.2.0
Patched in: 2.2.0

Summary: Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags

Details:
### Summary
Inserting unsanitized data into the blog tag field in Formwork CMS results in stored cross‑site scripting (XSS).
Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. Because the issue is persistent and impacts privileged administrative workflows, the severity is elevated.

### Details
Formwork CMS fails to properly sanitize data inserted into tags, before saving them and rendering them into the edit blog interface.  When a specially crafted tag becomes saved as a tag into the system, it is unable to be removed.  Any attempt to remove the tag from the affected post, causes the XSS to trigger once again.

Additionally, once the malicious tag is present, managing standard tags becomes impossible. This is due to script execution on attempted modification. This leads to a form of interface lockout where the payload continually reinserts itself due to the stored, unsafe rendering.

### Impact
This is a stored cross‑site scripting (XSS) vulnerability.

This impacts all users who access the affected blog post’s edit page.

### Patches
[Formwork 2.2.0](https://github.com/getformwork/formwork/releases/tag/2.2.0) ensures proper escaping of user input in tag fields.
GitHub Security Advisory: GHSA-r63p-v37q-g74c
Package: phppgadmin/phppgadmin (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 7.13.0
Patched in: unpatched

Summary: phppgadmin contains an incorrect access control vulnerability

Details:
phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $_SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data.
GitHub Security Advisory: GHSA-g6xh-wrpf-v6j6
Package: phppgadmin/phppgadmin (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 7.13.0
Patched in: unpatched

Summary: phppgadmin contains a SQL injection vulnerability

Details:
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.
GitHub Security Advisory: GHSA-927w-vq5c-8gc3
Package: phppgadmin/phppgadmin (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 7.13.0
Patched in: unpatched

Summary: phppgadmin contains a SQL injection vulnerability

Details:
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
GitHub Security Advisory: GHSA-8x9v-8qgj-945x
Package: snipe/snipe-it (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 8.3.4
Patched in: unpatched

Summary: Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow

Details:
Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page.