Quipux vulnerabilities

Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via multiple parameters in various PHP files, including busqueda/busqueda.php, anexos_lista.php, Administracion/listas/*.php, asociar_documentos/*.php, radicacion/*.php, reportes/reporte_TraspasoDocFisico.php, tx/*.php, and uploadFiles/cargar_doc_digitalizado_paginador.php.

Quipux 4.0.1 through e1774ac allows enumeration of usernames and access to the Ecuadorian identification number for all registered users via the txt_login parameter in Administracion/usuarios/cambiar_password_olvido_validar.php.

A Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac affects anexos/anexos_nuevo.php via the asocImgRad parameter. The vulnerability allows injection of malicious script that may execute in the user's browser.