Vendor
CI4MS Backup Restore Zip Slip Vulnerability Leads to RCE
2 rules 2 TTPsThe CI4MS Backup restore function is vulnerable to Zip Slip, allowing remote code execution by uploading a malicious ZIP archive that writes PHP files to the public web root due to missing validation of entry names during extraction, affecting versions prior to 0.31.5.0.
CI4MS Authenticated Remote Code Execution via Theme Upload
2 rules 2 TTPsCI4MS versions 0.26.0.0 through 0.31.6.0 are vulnerable to remote code execution; an authenticated backend user with theme upload permissions can upload a crafted ZIP file containing a PHP file, which is then installed into the web-accessible public directory without filtering, allowing direct execution via HTTP.
Admidio Inverted 2FA Reset Allows Privilege Escalation
2 rules 2 TTPsA logic error in Admidio's two-factor authentication reset inverts the authorization check, allowing non-admin users to remove other users' TOTP, including administrators, reducing their security to password-only authentication in versions 5.0.8 and earlier.
AzuraCast Path Traversal Leads to Remote Code Execution
2 rules 3 TTPs 3 IOCsAzuraCast is vulnerable to path traversal in the Flow.js media upload endpoint, allowing authenticated users with media permissions to write arbitrary files, leading to remote code execution via PHP webshell upload.
AzuraCast Account Takeover via X-Forwarded-Host Poisoning
2 rules 3 TTPs 2 IOCsAzuraCast is vulnerable to password reset poisoning due to unconditionally trusting the X-Forwarded-Host header, allowing an attacker to inject a malicious host into the password reset URL, exfiltrate the reset token, reset the victim's password, and disable 2FA, leading to account takeover.
CI4MS Theme Upload Zip Slip Vulnerability
2 rules 2 TTPsA critical vulnerability exists in ci4ms Theme::upload, where improper validation of ZIP archive entry names allows authenticated users with theme creation permissions to write files to arbitrary locations, leading to remote code execution.