CVE-2022-1033

CVE-2022-1033 affects crater-invoice/crater prior to 6.0.6 where there is no restriction on uploading dangerous file types. A PoC shows uploading a PHP webshell as an expense receipt, resulting in a stored file retrievable via attachment_receipt_url (e.g., /storage/50/2137webshell.php), enabling ...

CVE-2022-1033 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...

PT-2022-13606

Name of the Vulnerable Software and Affected Versions crater-invoice/crater versions prior to 6.0.6 Description The issue concerns an unrestricted upload of a file with a dangerous type. This problem is related to the GitHub repository crater-invoice/crater. Recommendations For versions prior to...

CVE-2022-1033: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...

GitHub repository crater-invoice/crater 代码问题漏洞

GitHub is a suite of hosting platforms for open source and private software projects. A security vulnerability exists in the GitHub repository crater-invoice/crater prior to version 6.0.6, which stems from the application's lack of an upload restriction for dangerous types of files...

CVE-2022-0515

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0514

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...

CVE-2022-0514

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...

CVE-2022-0515

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0515 Cross-Site Request Forgery (CSRF) in crater-invoice/crater

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0515 Cross-Site Request Forgery (CSRF) in crater-invoice/crater

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0515

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0515

CVE-2022-0515 is a CSRF vulnerability in crater-invoice/crater prior to version 6.0.4. The issue affects the web application’s CSRF protection, enabling an attacker to cause a logged-in user to be logged out by visiting a malicious site (PoC shows triggering a logout). The condition is that the v...

CVE-2022-0514

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...

CVE-2022-0514 Business Logic Errors in crater-invoice/crater

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...

PT-2022-13230

Name of the Vulnerable Software and Affected Versions crater-invoice/crater versions prior to 6.0.5 Description The issue concerns Business Logic Errors in the GitHub repository crater-invoice/crater. Recommendations For versions prior to 6.0.5, update to version 6.0.5 or later to resolve the iss...

CVE-2022-0514: Undefined Security Weakness

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...

Crater Invoice Crater 跨站请求伪造漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. A cross-site request forgery vulnerability existed in Crater Invoice Crater prior to 6.0.4, no information about this...

PT-2022-13231

Name of the Vulnerable Software and Affected Versions crater-invoice/crater versions prior to 6.0.4 Description The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository crater-invoice/crater. Recommendations For versions prior to 6.0.4, update to version 6.0.4 or later to...

Sourcecodester Simple Client Management System SQL注入漏洞

Sourcecodester Simple Client Management System is a simple web-based application that provides an online platform to manage company customer invoices. sourcecodester Simple Client Management System is vulnerable to SQL injection vulnerability, which stems from the application's lack of validation...