Light0011
Monthly
Information disclosure in light0011 CMS exposes database debug output to unauthenticated remote attackers by manipulating the DB_DEBUG argument processed by the Debug Mode component in App/Common/Conf/config.php. The flaw allows network-accessible attackers to retrieve database diagnostic data - potentially including SQL query traces, schema details, or connection metadata - with no authentication and no user interaction required. A public proof-of-concept exploit exists via GitHub issue #17, and the vendor has not yet responded to the coordinated disclosure report, leaving all deployed instances unpatched.
Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.
Unrestricted file upload in light0011 CMS allows unauthenticated remote attackers to upload arbitrary file types - including PHP webshells - via the Upload::upload function in the ThinkPHP-based CMS. The affected code is confirmed at commits c774dce and f72cf46 in the light0011/cms GitHub repository. A public proof-of-concept exploit has been released via a GitHub issue report; the vendor has not responded and no patched version exists.
Cross-site scripting in light0011 CMS allows remote attackers to inject arbitrary JavaScript into chapter content pages by manipulating the `content` argument processed through PHP's `htmlspecialchars_decode()` function in the chapter template. The misuse of this function-which decodes HTML entities rather than encoding them-means user-supplied chapter content is rendered as raw HTML in victims' browsers. A public proof-of-concept is available via GitHub issue #8, and the project maintainer has not responded to the coordinated disclosure.
Authorization bypass in the light0011 CMS Chapter Controller (ChapterController.class.php) exposes chapter content to unauthenticated remote attackers through insecure direct object reference (IDOR). By manipulating the `content` argument in HTTP requests, an attacker can reference chapter objects they are not permitted to access, circumventing the controller's access control entirely. A public exploit was disclosed via GitHub issue #5; the maintainer has not yet responded to the responsible disclosure report.
Server-side request forgery in light0011 CMS allows unauthenticated remote attackers to force the server to fetch arbitrary URLs by manipulating the `source[]` parameter in the bundled UEditor `catchimage` function at `Public/ueditor/php/controller.php`. Successful exploitation enables internal network reconnaissance, access to cloud metadata services (e.g., AWS IMDSv1), and pivoting to other HTTP endpoints not exposed externally. A public exploit exists via GitHub issue #6; the maintainer has not responded to disclosure and no patch has been released.
SQL injection in light0011 CMS exposes all deployments to unauthenticated remote database compromise through the ChapterModel::searchChapter function, where the `content` argument is passed unsanitized to the Query Builder in App/Home/Controller/ChapterController.class.php. Because the project uses no versioning, every deployed commit of this PHP CMS is affected with no vendor-patched baseline to target. A public proof-of-concept exploit is available via GitHub issue #7, and the project maintainer has not responded to disclosure, leaving no official remediation path.
Information disclosure in light0011 CMS exposes database debug output to unauthenticated remote attackers by manipulating the DB_DEBUG argument processed by the Debug Mode component in App/Common/Conf/config.php. The flaw allows network-accessible attackers to retrieve database diagnostic data - potentially including SQL query traces, schema details, or connection metadata - with no authentication and no user interaction required. A public proof-of-concept exploit exists via GitHub issue #17, and the vendor has not yet responded to the coordinated disclosure report, leaving all deployed instances unpatched.
Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.
Unrestricted file upload in light0011 CMS allows unauthenticated remote attackers to upload arbitrary file types - including PHP webshells - via the Upload::upload function in the ThinkPHP-based CMS. The affected code is confirmed at commits c774dce and f72cf46 in the light0011/cms GitHub repository. A public proof-of-concept exploit has been released via a GitHub issue report; the vendor has not responded and no patched version exists.
Cross-site scripting in light0011 CMS allows remote attackers to inject arbitrary JavaScript into chapter content pages by manipulating the `content` argument processed through PHP's `htmlspecialchars_decode()` function in the chapter template. The misuse of this function-which decodes HTML entities rather than encoding them-means user-supplied chapter content is rendered as raw HTML in victims' browsers. A public proof-of-concept is available via GitHub issue #8, and the project maintainer has not responded to the coordinated disclosure.
Authorization bypass in the light0011 CMS Chapter Controller (ChapterController.class.php) exposes chapter content to unauthenticated remote attackers through insecure direct object reference (IDOR). By manipulating the `content` argument in HTTP requests, an attacker can reference chapter objects they are not permitted to access, circumventing the controller's access control entirely. A public exploit was disclosed via GitHub issue #5; the maintainer has not yet responded to the responsible disclosure report.
Server-side request forgery in light0011 CMS allows unauthenticated remote attackers to force the server to fetch arbitrary URLs by manipulating the `source[]` parameter in the bundled UEditor `catchimage` function at `Public/ueditor/php/controller.php`. Successful exploitation enables internal network reconnaissance, access to cloud metadata services (e.g., AWS IMDSv1), and pivoting to other HTTP endpoints not exposed externally. A public exploit exists via GitHub issue #6; the maintainer has not responded to disclosure and no patch has been released.
SQL injection in light0011 CMS exposes all deployments to unauthenticated remote database compromise through the ChapterModel::searchChapter function, where the `content` argument is passed unsanitized to the Query Builder in App/Home/Controller/ChapterController.class.php. Because the project uses no versioning, every deployed commit of this PHP CMS is affected with no vendor-patched baseline to target. A public proof-of-concept exploit is available via GitHub issue #7, and the project maintainer has not responded to disclosure, leaving no official remediation path.