ShowDoc vulnerabilities

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc before 2.8.7.

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. An authenticated attacker can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.

A vulnerability in star7th showdoc up to 3.9.1 affects unknown code in the file web_src/public/editor.md/editormd.js of the API Page Save Endpoint. Manipulation can lead to cross-site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 resolves the issue. The patch sets Mermaid 'securityLevel' to 'strict', disables 'htmlLabels', and sanitizes rendered SVG with DOMPurify.

A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0 affecting an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the API Page Sort Endpoint component. Manipulation of the pages argument can lead to SQL injection. The attack may be launched remotely.