Threat database

HortusFox (hortusfox-web) versions up to 6.3 have an unrestricted file upload vulnerability in the PlantAttachmentModel component. Authenticated users can upload files with arbitrary extensions to the public attachments directory. This allows uploading of HTML or SVG files that can lead to stored cross-site scripting (XSS), or PHP files that may execute code if .htaccess restrictions are not enforced.

HortusFox (hortusfox-web) versions before 6.2 contain an SQL injection vulnerability in the /api/locations/list endpoint. The flaw allows API token holders to inject SQL via crafted include_info values, enabling unauthorized reading of database tables including user password hashes. This vulnerability has a high severity score of 7.1 and does not require user interaction or privileges beyond API token access.

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely for data portability, to deploy and execute malicious code on the underlying application server host.