Webgalamb

In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, atment_sddd1xGz, or xls_bgimport query parameters, most of these methods become available to unauthenticated users.

Published: 2019-03-17T18:32:11.000Z
Updated: 2024-08-05T11:37:11.510Z

In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation requires authentication bypass to access administrative functions of the site to upload a crafted CSV file with a malicious payload that becomes part of a PHP eval() expression in the subscriber.php file.

Published: 2019-03-17T22:06:16.000Z
Updated: 2024-08-05T11:37:11.520Z

In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensitive client data (email addresses) and also facilitates exploitation of SQL injection errors.

Published: 2019-03-17T22:02:20.000Z
Updated: 2024-08-05T11:37:11.593Z

In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by authenticated administrator users, because PHP files are restored under the document root directory.

Published: 2019-03-17T21:58:48.000Z
Updated: 2024-08-05T11:37:11.504Z

subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header.

Published: 2019-03-17T21:53:19.000Z
Updated: 2024-08-05T11:37:11.530Z