Lubelog
Monthly
Authenticated users of LubeLogger prior to 1.6.8 - including non-administrative accounts - can abuse the translation file upload path to place or overwrite files outside the intended storage directory, because the RenameFile helper constructs the destination path by string replacement without verifying that the resolved absolute path remains under the web root or data directory. Exploitation requires only a valid low-privileged session and a crafted upload file name, giving the attacker the file-system rights of the application process, which is why the assessed impact is high integrity with limited availability and no confidentiality component. Vendor-released patch: 1.6.8; no public exploit identified at time of analysis.
Authenticated users of LubeLogger versions prior to 1.6.8 can copy other users' vehicle maintenance records into a vehicle they control, because the DuplicateRecordsToOtherVehicles endpoint authorizes the destination vehicle but never checks edit permission on the source vehicle. This exposes the contents of service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection and equipment records, including attachment paths, and creates persistent attacker-held copies. The flaw is rated CVSS 3.1 7.1 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) and only matters on multi-user or household-shared instances; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis. The vendor-released patch: 1.6.8.
Authenticated users of LubeLogger prior to 1.6.8 - including non-administrative accounts - can abuse the translation file upload path to place or overwrite files outside the intended storage directory, because the RenameFile helper constructs the destination path by string replacement without verifying that the resolved absolute path remains under the web root or data directory. Exploitation requires only a valid low-privileged session and a crafted upload file name, giving the attacker the file-system rights of the application process, which is why the assessed impact is high integrity with limited availability and no confidentiality component. Vendor-released patch: 1.6.8; no public exploit identified at time of analysis.
Authenticated users of LubeLogger versions prior to 1.6.8 can copy other users' vehicle maintenance records into a vehicle they control, because the DuplicateRecordsToOtherVehicles endpoint authorizes the destination vehicle but never checks edit permission on the source vehicle. This exposes the contents of service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection and equipment records, including attachment paths, and creates persistent attacker-held copies. The flaw is rated CVSS 3.1 7.1 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) and only matters on multi-user or household-shared instances; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis. The vendor-released patch: 1.6.8.