kodbox vulnerabilities

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02 in the file /user/sso/apiLogin of the SSO API Login component. Manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A security vulnerability was detected in kalcaddle Kodbox up to 1.64 in the parseVideoInfo function of the VideoResize.class.php file within the fileThumb Plugin. Manipulating the ffmpegBin argument leads to command injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.

In kodbox up to version 1.64, a Server-Side Request Forgery (SSRF) vulnerability exists in the shareMake/shareCheck component. Manipulating the siteFrom/siteTo arguments allows server-side requests. The attack is remote but difficult. The exploit is public. The vendor did not respond.

kalcaddle kodbox up to version 1.61.09 has a path traversal vulnerability in the fileOut function in app/controller/explorer/index.class.php. Manipulation of the path argument allows remote attack. The exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond.

A vulnerability in kodbox version 1.52.04 and earlier allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.