Igor Scheller

4 exploits Active since Dec 2018
CVE-2018-19182 WRITEUP HIGH WRITEUP
engelsystem < 3.0.0 - Cross-Site Request Forgery
Engelsystem before commit hash 2e28336 allows CSRF.
CVSS 8.8
CVE-2023-45152 WRITEUP LOW WRITEUP
engelsystem < 2023-09-18 - Blind Server-Side Request Forgery via Import Schedule Functionality
Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.
CVSS 2.0
CVE-2023-45659 WRITEUP LOW WRITEUP
engelsystem < 2023-09-18 - Insufficient Session Expiration
Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.
CVSS 3.6
CVE-2023-50924 WRITEUP HIGH WRITEUP
engelsystem < 3.4.1 - Authenticated Stored XSS via DECT/Mobile Number & Work-Log Comment
Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user's context. This vulnerability enables an authenticated user to inject Javascript into other user's sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1.
CVSS 7.3