Filepress
Monthly
Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.
Authenticated FilePress users can delete, rename or read folders belonging to other libraries in versions through 3.0.1, because the pichome permission check validates membership of any library instead of the specific library being operated on. The attacker must supply a foreign library appid or folder id to folder.php (deletefolder, rename) or rightdata.php (getfolderdata), so practical impact is bounded by how easily those identifiers can be learned; scoring reflects that prerequisite, with the input CVSS 4.0 vector at 2.3 (AT:P) and our assessment at CVSS 3.1 AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity and availability impact. No public exploit code is confirmed at time of analysis, though a public technical write-up describing the IDOR is referenced, and the issue is a monitor-priority item rather than an active emergency.
SQL injection in zyx0814 FilePress up to version 3.0.1 allows remote unauthenticated attackers to manipulate database queries via the orderby and order parameters in dzz/publish/search.php. The Publish Module's search endpoint accepts unsanitized user-controlled sorting parameters directly into a SQL ORDER BY clause, enabling blind or time-based data extraction. A publicly available proof-of-concept exploit exists; the vendor has not responded to the coordinated disclosure report as of the time of analysis.
SQL injection in FilePress up to version 2.2.0 allows unauthenticated remote attackers to manipulate the order parameter in the Shares Filelist API (dzz/shares/admin.php and dzz/shares/ajax.php) to execute arbitrary SQL queries. The vulnerability exploits insufficient input validation on the order parameter, enabling data exfiltration or manipulation. Publicly available exploit code exists, and a vendor patch has been released.
Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.
Authenticated FilePress users can delete, rename or read folders belonging to other libraries in versions through 3.0.1, because the pichome permission check validates membership of any library instead of the specific library being operated on. The attacker must supply a foreign library appid or folder id to folder.php (deletefolder, rename) or rightdata.php (getfolderdata), so practical impact is bounded by how easily those identifiers can be learned; scoring reflects that prerequisite, with the input CVSS 4.0 vector at 2.3 (AT:P) and our assessment at CVSS 3.1 AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity and availability impact. No public exploit code is confirmed at time of analysis, though a public technical write-up describing the IDOR is referenced, and the issue is a monitor-priority item rather than an active emergency.
SQL injection in zyx0814 FilePress up to version 3.0.1 allows remote unauthenticated attackers to manipulate database queries via the orderby and order parameters in dzz/publish/search.php. The Publish Module's search endpoint accepts unsanitized user-controlled sorting parameters directly into a SQL ORDER BY clause, enabling blind or time-based data extraction. A publicly available proof-of-concept exploit exists; the vendor has not responded to the coordinated disclosure report as of the time of analysis.
SQL injection in FilePress up to version 2.2.0 allows unauthenticated remote attackers to manipulate the order parameter in the Shares Filelist API (dzz/shares/admin.php and dzz/shares/ajax.php) to execute arbitrary SQL queries. The vulnerability exploits insufficient input validation on the order parameter, enabling data exfiltration or manipulation. Publicly available exploit code exists, and a vendor patch has been released.