nedlir

SQL Injection via Metric Filter Names in BillaBear

BillaBear's metric filter system directly interpolates user-controlled filter names into SQL queries using sprintf() without sanitization. While filter values are properly parameterized, filter names (column identifiers) are concatenated directly into SQL strings in EventRepository.php. An authenticated user with ROLE_ACCOUNT_MANAGER can inject malicious SQL through metric filter names, achieving full database compromise when usage calculations execute.

Vulnerability Summary

• Type: CWE-89 (SQL Injection)
• Affected Version: 2025.01.01, 2025.01.02, and 2025.01.03 (latest GitHub release at time of disclosure; verified on 2025.01.03)
• Affected Component: src/BillaBear/Repository/Usage/EventRepository.php
• Attack Vector: Network (Remote)
• Authentication Required: Yes (ROLE_ACCOUNT_MANAGER or higher)

nedlir

Missing Authentication on Critical API Endpoints

The Pharmacy Management System exposes multiple critical API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including all users (with password hashes), drug inventory, doctor prescriptions, and financial records. Limited write access allows unauthorized modification and deletion of users, inventory, and medical data.

Vulnerability Summary

• Type: CWE-306 (Missing Authentication for Critical Function)
• Affected Version: Commit 5c3d028c520628ece50f034900e0a98c07943d70 (latest master); package.json version 0.0.0; Angular CLI 8.3.6 (no versioned GitHub releases or tags)
• Affected Component: Multiple backend route files (user.js, inventory.js, doctorUser.js, doctorOders.js, sales.js, etc.)
• Attack Vector: Network (Remote)
• Authentication Required: None

nedlir

Privilege Escalation via Unvalidated Role Assignment - LalanaChami Pharmacy Management System

LalanaChami's Pharmacy Management System signup endpoint (backend/routes/user.js) accepts a user-controlled role parameter and directly assigns it to new user accounts without server-side validation. The role field is passed from req.body.role directly into the User model constructor with no whitelist or enum validation. Any unauthenticated attacker can inject "role": "admin" during registration to gain full administrative privileges.

---

Vulnerability Summary

• Type: CWE-269 (Improper Privilege Management)
• Affected Version: Commit 5c3d028c520628ece50f034900e0a98c07943d70 (latest master); package.json version 0.0.0; Angular CLI 8.3.6 (no versioned GitHub releases or tags)
• Affected Component: backend/routes/user.js - signup endpoint

nedlir

Remote Code Execution via Insecure Deserialization in APScheduler JSONSerializer

The APScheduler JSONSerializer (and CBORSerializer) are documented as secure alternatives to Python's pickle, but both implement a custom object reconstruction mechanism that allows for arbitrary class instantiation and state injection. This design flaw enables Remote Code Execution (RCE) via insecure deserialization.

Vulnerability Summary

• Type: CWE-502 (Deserialization of Untrusted Data)
• Affected Version: 4.0.0a3, 4.0.0a4, 4.0.0a5, and 4.0.0a6 (all published GitHub releases in the 4.x pre-release line; verified on 4.0.0a6). JSON/CBOR serializers were introduced in 4.0.0a1 per upstream changelog. The 3.x release line (latest stable: 3.11.2) does not include these serializers.
• Attack Vector: Network (when attacker-controlled serialized data reaches the deserializer)
• Authentication Required: Depends on deployment

nedlir

A Server-Side Request Forgery (SSRF) vulnerability has been identified in OpenBoxes, an open-source supply chain management system used by healthcare and humanitarian organizations. This vulnerability allows authenticated users to make arbitrary HTTP requests from the server, potentially leading to:

• Cloud metadata service access (AWS, GCP, Azure credential theft)
• Internal network reconnaissance and service discovery
• Access to internal services not exposed to the internet

Vulnerability Details

Affected Version

nedlir

A Privilege Escalation vulnerability has been identified in OpenBoxes, an open-source supply chain management system used by healthcare and humanitarian organizations. This vulnerability allows users with Manager role (a non-admin role) to escalate their privileges to Admin, potentially leading to:

• Full administrative access to the system
• Creation of persistent backdoor admin accounts
• Access to all user data and system settings
• Ability to compromise other user accounts

Key Finding: Manager role users, who are intended to only manage inventory and shipments, can create new users and assign them Admin privileges. This bypasses the intended role hierarchy and grants unauthorized administrative access.

Vulnerability Details

nedlir

A Server-Side Template Injection (SSTI) vulnerability has been identified in OpenBoxes, an open-source supply chain management system used by healthcare and humanitarian organizations. This vulnerability allows authenticated users to achieve Remote Code Execution (RCE) on the server, potentially leading to:

• Full server compromise with arbitrary command execution
• Data exfiltration of sensitive healthcare supply chain information
• Lateral movement to connected systems
• Persistent backdoor installation

Key Finding: While uploading malicious documents requires Manager role (a non-admin role commonly assigned to inventory staff), triggering the RCE only requires Browser role (the lowest authenticated role). This means any Manager can plant a malicious document, and ANY authenticated user can trigger it.

Vulnerability Details

nedlir

The productSupplier controller's edit action lacked any server-side authorization check. While the create and delete actions were protected by a runtime.groovy RBAC rule requiring ROLE_ADMIN with supplemental ROLE_PRODUCT_MANAGER, the edit action was completely omitted from both the runtime.groovy rules and the RoleInterceptor hardcoded action maps.

This allowed any authenticated user with the lowest privilege level (ROLE_BROWSER) to modify existing product supplier records, including changing supplier names, codes, and manufacturer associations.

Vulnerability Details

Title	CWE	Affected Versions	Fixed In	Patch Date
Missing Authorization on productSupplier/edit Controller Acti

nedlir

The document controller's uploadDocument action used a flawed validation mechanism to prevent template-type documents from being uploaded to stock movements, shipments, purchase orders, and invoices. While the validation intended to restrict these uploads, it relied on DocumentService.getNonTemplateDocumentTypes() to return DocumentType domain objects and used .contains() to check whether the uploaded document type was in the non-template list.

This allowed an authenticated user with document upload access to bypass the validation and successfully attach forbidden template-type documents to restricted records due to object equality issues with Hibernate entities, dynamic service dependencies, or inverted validation logic.

Vulnerability Details

| Title | CWE | Affected Versions | Fixed In | Patch Date | | -------------------------------------------