65 matches found
CVE-2022-1032
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...
CVE-2022-0203
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2...
CVE-2024-55556
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...
CVE-2024-55556
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...
CVE-2024-55556
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...
CVE-2024-55556
A CVE in Crater Invoice (InvoiceShelf/META: Laravel cookie-based session deserialization) enables unauthenticated remote code execution when an attacker obtains Laravel APP_KEY. Public docs describe that manipulating the laravel_session cookie, which contains serialized session data encrypted wit...
CVE-2024-55556
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...
PT-2024-36552 · Unknown · Crater Invoice
Name of the Vulnerable Software and Affected Versions: Crater Invoice affected versions not specified Description: A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP KEY to achieve remote command execution on the server by manipulating the laravel sessi...
CVE-2022-1032
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...
Deserialization of untrusted data
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...
CVE-2022-1032
CVE-2022-1032 affects the Crater Invoice Crater project prior to 6.0.6, reported as insecure deserialization of unvalidated module files. The exploit path demonstrated in the documents involves uploading a manipulated Phar archive (phar.phar) via the web API, then triggering remote code execution...
CVE-2022-1032 Insecure deserialization of not validated module file in crater-invoice/crater
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...
Crater Invoice Crater 代码问题漏洞
Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. A security vulnerability exists in Crater Invoice Crater versions prior to 6.0.6 that stems from insecure deserialization ...
CVE-2022-1033
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...
CVE-2022-1033
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...
CVE-2022-1033
CVE-2022-1033 affects crater-invoice/crater prior to 6.0.6 where there is no restriction on uploading dangerous file types. A PoC shows uploading a PHP webshell as an expense receipt, resulting in a stored file retrievable via attachment_receipt_url (e.g., /storage/50/2137webshell.php), enabling ...
CVE-2022-1033 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...
GitHub repository crater-invoice/crater 代码问题漏洞
GitHub is a suite of hosting platforms for open source and private software projects. A security vulnerability exists in the GitHub repository crater-invoice/crater prior to version 6.0.6, which stems from the application's lack of an upload restriction for dangerous types of files...