DevaslanPHP project-management vulnerabilities

In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the updateJiraProjects function in the /jira-import file of the Jira Import component leads to server-side request forgery via manipulation of host/username/token arguments. The attack can be initiated remotely. The exploit has been disclosed to the public.

In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack may be performed remotely. The exploit has been published.

In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack can be carried out remotely. The exploit is now public.

In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the KanbanScrumHelper::recordUpdated function in app/Helpers/KanbanScrumHelper.php. The attack can be performed remotely. The project has not responded.

In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the editComment/doDeleteComment functions in app/Filament/Resources/TicketResource/Pages/ViewTicket.php. The attack can be performed remotely. The project has not responded.