FOGProject Fogproject

FOG's authentication bypass leads to full SQL DB dump

FOG has a command injection in /fog/management/export.php?filename=

FOG leaks sensitive information (AD domain, username and password)

FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).

FOG Authenticated File Upload RCE

FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page

FOG SSRF via unauthenticated endpoint(s)

FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules

FOG Weak file permissions

configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure). In order to exploit the vulnerability, someone needs to mount an NFS share in order to add an executable file as root. In addition, the SUID bit must be added to this file.

FOG Sensitive Information Disclosure

NFS server misconfiguration allows file access outside the exported directory

FOG stored XSS on log screen via unsanitized request logging

FOG path traversal via unauthenticated endpoint

FOG has Stored XSS in Multiple Management Pages

FOG has a Log Information Disclosure

FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab