CVE Vulnerability Catalog

Nozomi Networks Labs identified a CWE-78 (OS Command Injection) vulnerability in the edgserver management service of Advantech EKI-1242EIMS firmware version V1.06.01. It allows a remote unauthenticated attacker to execute arbitrary OS commands as root via crafted requests to TCP port 5058.

A CWE-73: External Control of File Name or Path vulnerability exists in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.

A CWE-94 code injection vulnerability was identified in the Modbus CSV import workflow of Advantech EKI-1242EIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary Lua code on the device via a crafted imported file.

Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store malicious script content that executes in the browser of any administrator who later opens an affected management page.

A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.

A CWE-94 code injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary code on the device, including OS commands as root.

A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.

A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.

A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.

A CWE-352 Cross-Site Request Forgery vulnerability was identified in the LuCI administrative web interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote unauthenticated attacker can perform unauthorized state-changing requests on behalf of a logged-in administrator, enabling unauthorized access to privileged management functions.

An SQL Injection vulnerability was identified in the Themeum WP Mega Menu plugin, allowing Blind SQL Injection. This issue affects WP Mega Menu versions from n/a through 1.4.2.

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required permissions to remove approval steps that control contract, receivable, and invoice finalization processes.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses.

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers without proper permission checks.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to withdraw entire product catalogs from sale or re-enable withdrawn products without proper permission checks.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary addresses.

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy.

yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST /admin-api/crm/customer/send-mail with arbitrary customerIds, templateCode, and templateParams to deliver unauthorized messages through the organization's SMS and email channels.