Threat Intelligence Database

HortusFox (hortusfox-web) versions up to and including 6.3 have an unrestricted file upload vulnerability in the PlantAttachmentModel component. Authenticated users can upload files with arbitrary extensions to the public attachments directory, including potentially dangerous types such as HTML, SVG, or PHP. This can lead to stored cross-site scripting (XSS) or remote code execution if .htaccess restrictions are not enforced.

HortusFox (hortusfox-web) versions before 6.2 have an SQL injection vulnerability in the /api/locations/list endpoint. API token holders can exploit this by supplying crafted include_info values, allowing them to inject SQL subqueries. This can lead to unauthorized reading of any database table, including user password hashes. The vulnerability has a high severity score of 7.1 and requires careful remediation.

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely for data portability, to deploy and execute malicious code on the underlying application server host.