Ocsreports
Monthly
Stored cross-site scripting in OCS Inventory NG's ocsreports web console lets an administrator plant malicious HTML/JavaScript in the notification template (endpoint /ocsreports/?function=notification) that executes in the browser of any other administrator who opens the template customisation view. The injected script runs in the application's security context, enabling session hijacking or privileged actions against fellow admins. Reported by INCIBE; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
SSRF in OCSreports (OCS Inventory NG) allows authenticated operators to weaponize the inventory server as a proxy to reach internal network services or cloud metadata endpoints via the /ocsreports/?function=tele_activate endpoint. By supplying attacker-controlled values for the HTTPS_SERV and FILE_SERV parameters, an operator-level account can cause the server to issue outbound HTTP/HTTPS requests to otherwise-inaccessible destinations, including cloud provider metadata APIs such as AWS IMDSv1. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by INCIBE as part of a multi-flaw advisory.
SQL injection in OCSReports (OCS Inventory NG) at the admin_double function endpoint allows authenticated operator-level users to manipulate the `selected_grp_dupli[]` array parameter to alter backend SQL queries and extract or modify data from the application database. All versions are affected per CPE, with the attack requiring only a valid operator account over the network. No active exploitation has been identified at time of analysis, but the low privilege bar and high data impact make this a meaningful insider or credential-compromise risk.
SQL injection in OCSReports (OCS Inventory NG) allows authenticated users holding operator privileges to extract or manipulate the full application database via the unsanitized `del_check` parameter at the `/ocsreports/?function=save_query_list` endpoint. The CVSS 4.0 score of 8.6 reflects a network-accessible, low-complexity attack path with high confidentiality and integrity impact against the underlying database. No public exploit code and no active exploitation have been identified at time of analysis; however, the standard SQLi technique and low privilege bar make this straightforward for any operator-level insider or compromised account holder.
Remote code execution in OCS Inventory NG's Ocsreports web console (admin_info CSV upload endpoint) allows an authenticated administrator to upload a PHP webshell that, once processed, runs arbitrary code as the web-service account. The upload routine trusts the client-supplied filename and never validates file content or securely restricts extensions (CWE-434), so a benign-looking CSV import becomes a code-execution primitive. Disclosed via INCIBE as part of a multi-vulnerability advisory for Ocsreports; no public exploit identified at time of analysis, and no EPSS or KEV signal is present in the input.
Stored cross-site scripting in OCS Inventory NG's ocsreports web console lets an administrator plant malicious HTML/JavaScript in the notification template (endpoint /ocsreports/?function=notification) that executes in the browser of any other administrator who opens the template customisation view. The injected script runs in the application's security context, enabling session hijacking or privileged actions against fellow admins. Reported by INCIBE; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
SSRF in OCSreports (OCS Inventory NG) allows authenticated operators to weaponize the inventory server as a proxy to reach internal network services or cloud metadata endpoints via the /ocsreports/?function=tele_activate endpoint. By supplying attacker-controlled values for the HTTPS_SERV and FILE_SERV parameters, an operator-level account can cause the server to issue outbound HTTP/HTTPS requests to otherwise-inaccessible destinations, including cloud provider metadata APIs such as AWS IMDSv1. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by INCIBE as part of a multi-flaw advisory.
SQL injection in OCSReports (OCS Inventory NG) at the admin_double function endpoint allows authenticated operator-level users to manipulate the `selected_grp_dupli[]` array parameter to alter backend SQL queries and extract or modify data from the application database. All versions are affected per CPE, with the attack requiring only a valid operator account over the network. No active exploitation has been identified at time of analysis, but the low privilege bar and high data impact make this a meaningful insider or credential-compromise risk.
SQL injection in OCSReports (OCS Inventory NG) allows authenticated users holding operator privileges to extract or manipulate the full application database via the unsanitized `del_check` parameter at the `/ocsreports/?function=save_query_list` endpoint. The CVSS 4.0 score of 8.6 reflects a network-accessible, low-complexity attack path with high confidentiality and integrity impact against the underlying database. No public exploit code and no active exploitation have been identified at time of analysis; however, the standard SQLi technique and low privilege bar make this straightforward for any operator-level insider or compromised account holder.
Remote code execution in OCS Inventory NG's Ocsreports web console (admin_info CSV upload endpoint) allows an authenticated administrator to upload a PHP webshell that, once processed, runs arbitrary code as the web-service account. The upload routine trusts the client-supplied filename and never validates file content or securely restricts extensions (CWE-434), so a benign-looking CSV import becomes a code-execution primitive. Disclosed via INCIBE as part of a multi-vulnerability advisory for Ocsreports; no public exploit identified at time of analysis, and no EPSS or KEV signal is present in the input.