Diem
Monthly
Insecure direct object reference (IDOR) in the dmWidget component of diem-project/diem (versions through 5.1.3) allows unauthenticated remote attackers to bypass authorization controls by manipulating the `widget_id` parameter in `BasedmWidgetActions.class.php`, exposing widget data belonging to other users or contexts. A public proof-of-concept exists via GitHub issue #450, and the upstream project has not responded to the coordinated disclosure despite early notification. The CVSS 4.0 score of 5.5 reflects the limited blast radius - confidentiality impact only, with no integrity or availability consequences confirmed.
Cross-site request forgery in diem-project/diem up to version 5.1.3 allows remote attackers to trigger unauthorized console command execution by tricking an authenticated administrator into visiting a malicious page. The vulnerability resides in the dmConsole module's executeCommand action, which processes the dm_command parameter without verifying request origin. A public proof-of-concept exploit exists via GitHub issue #449, and the vendor has not responded to the coordinated disclosure, leaving no patch available.
Unrestricted file upload in diem-project/diem through version 5.1.3 exposes the Widget Editor to remote authenticated attackers who can upload arbitrary file types - including executable PHP scripts - via the media form handler dmWidgetContentBaseMediaForm.php. If uploaded files reside in a web-accessible directory without server-enforced execution restrictions, this vulnerability escalates from a file-write primitive to full remote code execution. A public proof-of-concept is available through a GitHub issue; the project has not responded to the disclosure and no patch has been released.
OS command injection in the Diem CMS Administrative Console (diem-project/diem ≤ 5.1.3) allows authenticated administrators to execute arbitrary operating system commands on the host server via the unsanitized `dm_command` argument of the `executeCommand` function in `dmAdminPlugin/modules/dmConsole/actions/actions.class.php`. Publicly available exploit code exists via GitHub issue #447, and the project maintainers have not responded to the responsible disclosure report. The vulnerability is not in CISA KEV, but the unpatched status combined with available exploit code elevates urgency for any organization still running this abandoned software.
Insecure direct object reference (IDOR) in the dmWidget component of diem-project/diem (versions through 5.1.3) allows unauthenticated remote attackers to bypass authorization controls by manipulating the `widget_id` parameter in `BasedmWidgetActions.class.php`, exposing widget data belonging to other users or contexts. A public proof-of-concept exists via GitHub issue #450, and the upstream project has not responded to the coordinated disclosure despite early notification. The CVSS 4.0 score of 5.5 reflects the limited blast radius - confidentiality impact only, with no integrity or availability consequences confirmed.
Cross-site request forgery in diem-project/diem up to version 5.1.3 allows remote attackers to trigger unauthorized console command execution by tricking an authenticated administrator into visiting a malicious page. The vulnerability resides in the dmConsole module's executeCommand action, which processes the dm_command parameter without verifying request origin. A public proof-of-concept exploit exists via GitHub issue #449, and the vendor has not responded to the coordinated disclosure, leaving no patch available.
Unrestricted file upload in diem-project/diem through version 5.1.3 exposes the Widget Editor to remote authenticated attackers who can upload arbitrary file types - including executable PHP scripts - via the media form handler dmWidgetContentBaseMediaForm.php. If uploaded files reside in a web-accessible directory without server-enforced execution restrictions, this vulnerability escalates from a file-write primitive to full remote code execution. A public proof-of-concept is available through a GitHub issue; the project has not responded to the disclosure and no patch has been released.
OS command injection in the Diem CMS Administrative Console (diem-project/diem ≤ 5.1.3) allows authenticated administrators to execute arbitrary operating system commands on the host server via the unsanitized `dm_command` argument of the `executeCommand` function in `dmAdminPlugin/modules/dmConsole/actions/actions.class.php`. Publicly available exploit code exists via GitHub issue #447, and the project maintainers have not responded to the responsible disclosure report. The vulnerability is not in CISA KEV, but the unpatched status combined with available exploit code elevates urgency for any organization still running this abandoned software.