bumsys 安全漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. A security vulnerability exists in versions of bumsys prior to 2.2.0, which originates from an externally controlled file name or path...

CVE-2023-2551 PHP Remote File Inclusion in unilogies/bumsys

PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1...

PT-2023-20140 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.2.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application receives input from a user and stores it, allowing an attacker to inject malicious scripts. This...

PT-2023-20148 · Bumsys · Bumsys

Name of the Vulnerable Software and Affected Versions: bumsys versions prior to 2.2.0 Description: The issue concerns external control of file name or path in the GitHub repository unilogies/bumsys. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issu...

CVE-2023-2554

CVE-2023-2554 affects unilogies/bumsys prior to 2.2.0. The issue is External Control of File Name or Path, enabling path traversal via user-supplied input used to build file paths in easyUpload, potentially allowing arbitrary file write. Public sources (NVD/Red Hat/Rust) rate severity as HIGH (CV...

CVE-2023-2554 External Control of File Name or Path in unilogies/bumsys

External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0...

CVE-2023-2551

CVE-2023-2551 affects the PHP-based Bumsys (unilogies/bumsys) with versions prior to 2.1.1. The vulnerability stems from an API endpoint that processes file paths and allows local files to be included, enabling remote code execution via crafted requests to the api route. The root cause is unsafe ...

CVE-2023-2552

CVE-2023-2552 describes a CSRF vulnerability in unilogies/bumsys prior to 2.1.1. Connected sources provide a PoC: an attacker can reach ajax.php via /accounts/ajax without CSRF token, bypassing the check, potentially enabling unauthorized actions side-channel via a crafted request. The vulnerabil...

CVE-2023-2553

CVE-2023-2553 is a stored XSS in unilogies/bumsys prior to version 2.2.0. The vulnerability arises when user input (e.g., customerName) is stored and later rendered without proper escaping, enabling injected scripts as shown in PoC payloads (e.g., customerName containing ). Affected product: unil...

CVE-2023-2554 External Control of File Name or Path in unilogies/bumsys

External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0...

CVE-2023-2551 PHP Remote File Inclusion in unilogies/bumsys

PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1...

CVE-2023-2553 Cross-site Scripting (XSS) - Stored in unilogies/bumsys

Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to 2.2.0...

CVE-2023-2552 Cross-Site Request Forgery (CSRF) in unilogies/bumsys

Cross-Site Request Forgery CSRF in GitHub repository unilogies/bumsys prior to 2.1.1...

CVE-2023-1361

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...

Sql injection

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...

CVE-2023-1362 Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys

Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2...

CVE-2023-1361 SQL Injection in unilogies/bumsys

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...

PT-2023-16928 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.0.2 Description: The issue is related to SQL Injection. Recommendations: For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue...

PT-2023-16929 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.0.2 Description: The issue is related to improper restriction of rendered UI layers or frames. Recommendations: For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue...

CVE-2023-1361 SQL Injection in unilogies/bumsys

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...