PT-2024-17507 · Qibosoft · Qibocms X1

Name of the Vulnerable Software and Affected Versions: QiboSoft QiboCMS X1 versions up to 1.0.6 Description: A critical vulnerability was found in the function rmb pay of the file /application/index/controller/Pay.php. The manipulation of the argument callback class leads to deserialization. The...

DoS while calling pay() for the first time when the JBXBuybackDelegate.sol would not have any project's token

Lines of code Vulnerability details Impact 1. Let us assume a user calls the pay function in the JBPayoutRedemptionPaymentTerminal31.sol or the JBETHPaymentTerminal31.sol for the first time. By "for the first time", I mean that the JBXBuybackDelegate.sol does not have any of the project's tokens ...

The pay() function can still be DOSed

Lines of code Vulnerability details Impact From the prior contest: in the pay function users repay their debt and in line 364: it decreases their debt. lets say a user wants to repay all his debt, he calls the pay function with his full debt. an attacker can see it and frontrun to repay a single...

[WP-H1] Wrong timing of check allows users to withdraw collateral without paying for the debt

Lines of code Vulnerability details function payPayParam calldata param external override lock returns uint128 assetIn, uint128 collateralOut requireblock.timestamp = param.ids.length, 'E205'; for uint256 i; i = uint256collateralOut due.debt, 'E303'; due.debt -= param.assetsIni; due.collateral -=...

DOS pay function

Handle egjlmn1 Vulnerability details in the pay function users repay their debt and in line 364: it decreases their debt. lets say a user wants to repay all his debt, he calls the pay function with his full debt. an attacker can see it and frontrun to repay a single token for his debt since it's...