CVE-2022-41535

Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /saccoshield/manageborrower.php...

PT-2022-25921 · Unknown · Open Source Sacco Management System

Name of the Vulnerable Software and Affected Versions: Open Source SACCO Management System version 1.0 Description: A SQL injection issue was found in the id parameter at the /sacco shield/manage borrower.php API endpoint. Recommendations: For Open Source SACCO Management System version 1.0, avoi...

Open Source SACCO Management System SQL Injection Vulnerability

Open Source SACCO Management System is an open source SACCO management system by Mayuri K. Individual developer. A SQL injection vulnerability exists in Open Source SACCO Management System v1.0, which originates from a SQL injection vulnerability in the id parameter in...

CVE-2022-41530

Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /saccoshield/ajax.php?action=deleteborrower...

PT-2022-25917 · Unknown · Open Source Sacco Management System

Name of the Vulnerable Software and Affected Versions: Open Source SACCO Management System version 1.0 Description: A SQL injection issue was found in the Open Source SACCO Management System. The vulnerability can be exploited via the id parameter at the "/sacco shield/ajax.php?action=delete...

Open Source SACCO Management System SQL Injection Vulnerability

Open Source SACCO Management System is an open source SACCO management system by Mayuri K., a personal developer. A security vulnerability exists in version 1.0 of the Open Source SACCO Management System, which stems from an SQL injection issue in the id parameter of the...

CVE-2022-41530

Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /saccoshield/ajax.php?action=deleteborrower...

Approved Borrower can can walk away with collateral in leveraged borrowed Position

Lines of code Vulnerability details Impact When an approved borrower calls leveragedPosition , their userBorrowShares and userCollateralBalance values are updated. The borrow will be able to walk away with collateral balance by adding more collateral to pass the isSolvent check and remove all the...

BORROWER CAN BORROW ASSET FROM HIMSELF AND GET THE SHARES

Lines of code Vulnerability details Impact User can borrow the asset from lender which the lender is himself. The user will get the share after he lend his asset to himself. Proof of Concept First the user, let say Alice, will call borrowAsset and set the address of the receiver to msg.sender...

maxLTV == 0 shouldn't be solvent but currently always solvent, so borrower can borrow all assets without any collateral.

Lines of code Vulnerability details Impact maxLTV == 0 shouldn't be solvent but currently always solvent, so borrower can borrow all assets without any collateral since isSolvent always return true. Proof of Concept Assume maxLTV == 0 User call borrowAsset /// @notice The borrowAsset function is...

If maxLTV == 0 case is used for allowing unlimited borrowing without any collateral, borrower whitelist must be enforced.

Lines of code Vulnerability details Impact If maxLTV == 0 case is used for allowing unlimited borrowing without any collateral, borrower whitelist must be enforced since it is a kind of undercollateral. Proof of Concept function isSolventaddress borrower, uint256 exchangeRate internal view return...

Lender can immediately liquidate valued Collateral in NFTPairWithOracle contract

Lines of code Vulnerability details Impact A lender can liquidate a borrower's collateral immediately by calling updateLoanParams in the NFTPairWithOracle contract where the ltvBPS for the params struct is set to 0. This bypasses the checks to make sure that the terms are favourable to the...

Possible to steal collateral during a reentrant collateral transfer

Lines of code Vulnerability details Impact In NFTPair.sol218 an ERC-721 transfer occurs. Anyone who gains execution during this transfer after the owner of the token is changed can steal the token transferred. Note that it will be applicable only if !skim. Since the exploit makes assumptions abou...

Lender can unconditionally liquidate borrower by changing ltvBPS to 0

Lines of code Vulnerability details Impact In NFTPairWithOracle.updateLoanParams, a lender is allowed to decrease ltvBPS. If the lender set it to 0, he can call removeCollateral immediately to liquidate the borrower. Proof of Concept function updateLoanParamsuint256 tokenId, TokenLoanParams memor...

Borrower can update loan parameters and force lender into accepting near-unliquidatable loan

Lines of code Vulnerability details Impact While loan is in LOANREQUESTED phase, the updateLoanParameters function can be called by the borrower to adjust TokenLoanParams.ltvBPS to a value that is very unfavorable for a prospective lender. Usually, this results in the loan not being accepted by a...

Lender can unconditionally liquidate borrower by changing oracle

Lines of code Vulnerability details Impact In NFTPairWithOracle.updateLoanParams, a lender is allowed change the oracle. If the lender set it some oracle that return invalid price, he can call removeCollateral immediately to liquidate the borrower. Proof of Concept function updateLoanParamsuint25...

Blocking of Legitimate Liquidation

Lines of code Vulnerability details Issue: removeCollateral calculates whether liquidation is allowed via requirerate.mulloanParams.ltvBPS / BPS amount, "NFT is still valued";. An arbitrarily high ltvBPS will effectively bypass the oracle price and block liquidation. Consequences: A malicious...

Borrower can frontrun lender's call to lend to increase ltvBPS and avoid liquidation

Lines of code Vulnerability details Impact In NFTPairWithOracle.lend, the loan ltvBPS can be higher than the lender's accepted ltvBPS. This allow a borrower to watch the mempool and front-run the lender's call and change ltvBPS to some very large value using updateLoanParams to avoid liquidation...

Moral hazard of borrower calling liquidate() and potential Oracle manipulation

Lines of code Vulnerability details Impact In the InceptionVaultsCore contract, the liquidate and liquidatePartial function can be called anyone. This means that the borrower for a specific vaultId can call liquidate or liquidatePartial on his own vault. Furthermore, the project incentivizes...

Malicious owner can steal some funds from borrower

Lines of code Vulnerability details Impact Owner can make changes to the protocol with immediate effect. Malicious owner can watch for big lend in the mempool and front run it by maxing out originationFeeRate to 5%. The users, both lender and borrower, will still think that originationFeeRate is...