Corban Amouzou

3 exploits Active since Oct 2023
CVE-2023-46235 WRITEUP MEDIUM WRITEUP
fogproject < 1.5.10.15 - Stored Cross-Site Scripting via Log File Display
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.
CVSS 5.4
CVE-2023-46236 WRITEUP HIGH WRITEUP
FOG Project <1.5.10 - Unauthenticated Server-Side Request Forgery
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.
CVSS 8.6
CVE-2023-46237 WRITEUP MEDIUM WRITEUP
fogproject < 1.5.10 - Unauthenticated Path Traversal
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
CVSS 5.8