Threats affecting pkg:github/opencats/OpenCATS

OpenCATS versions prior to 0.10.0 contain a vulnerability in the Professional License configuration feature that allows an authenticated administrator with Settings module access to inject arbitrary PHP code. This occurs because license key input is unsafely incorporated into a PHP define() statement in config.php, which is writable. Exploitation can lead to persistent arbitrary PHP execution with web server privileges, enabling data exposure, modification, or deletion, and potential further compromise. The issue is fixed in version 0.10.0.

OpenCATS versions prior to 0.10.0 contain an improper input validation vulnerability in the activity DataGrid date filtering functionality. Authenticated users can manipulate the 'period', 'startDate', and 'endDate' parameters to alter SQL queries without proper escaping, potentially accessing sensitive database information. This issue is fixed in version 0.10.0.

OpenCATS versions 0.10.0 up to but not including 0.12.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows a low-privileged authenticated user to inject malicious HTML or JavaScript code into various name or title fields, which are then rendered unsanitized in the 'Recent' navigation panel on nearly every page. When other users, including administrators, view these records, the injected script executes in their sessions, potentially enabling session hijacking and privilege escalation. The vulnerability is fixed in OpenCATS version 0.12.0.

OpenCATS versions before 0.10.0 have an authorization bypass vulnerability in the CalendarUI component. Authenticated users with EDIT or DELETE permissions can manipulate the eventID parameter to modify or delete calendar events belonging to other users, including private events. This flaw is fixed in version 0.10.0.

OpenCATS versions before 0.10.0 have a missing authorization vulnerability in the ReportsUI::handleRequest() function. This flaw allows authenticated users without the canSeeEEOInfo permission to access EEO demographic reports, including aggregate ethnicity, veteran, gender, and disability statistics. The vulnerability is fixed in version 0.10.0.

OpenCATS versions before 0.10.0 have a missing authorization vulnerability in the ImportUI::handleRequest() function. This flaw allows authenticated users with only READ-level access to invoke the import module's revert action using an importID, resulting in mass deletion of imported candidate, company, and contact records. The vulnerability is fixed in OpenCATS version 0.10.0.

OpenCATS versions prior to 0.10.0 have a missing authorization vulnerability that allows authenticated users with read-level access to create, rename, delete, and modify saved lists via certain AJAX endpoints. This flaw enables unauthorized modification or deletion of any saved list across the site.

OpenCATS versions prior to 0.10.0 have a missing authorization vulnerability in ajax/testEmailSettings.php. This flaw allows any authenticated user with read-level privileges to send email through the configured SMTP relay by specifying arbitrary recipient and spoofed sender addresses. The issue is fixed in version 0.10.0.

OpenCATS versions prior to 0.10.0 have a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php. This flaw allows authenticated users with only READ-level permissions to edit or delete activity entries by supplying arbitrary activityID parameters. The vulnerability affects candidate, contact, and company activity and pipeline history data.

OpenCATS version 0.10.0 contains a vulnerability in the processLogin function of the Career Portal component that improperly restricts excessive authentication attempts. This flaw allows remote attackers to attempt multiple authentications with a high degree of complexity and difficulty. The project maintainer has released a patch that changes authentication to require CAPTCHA completion and maintains authenticated sessions server-side, removing reliance on client-side cookies. Rate limiting is recommended to be implemented outside the application at the network or proxy layer.