Openwebif Project Openwebif vulnerabilities

CVE-2017-9807 [CRITICAL] CWE-94 CVE-2017-9807: An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig fu An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands via api/saveconfig.

CVE-2017-9333 [HIGH] CWE-20 CVE-2017-9333: OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgControlle OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, when the URL refers to an attacker-controlled web site with a Trojan horse package. This has security implications in cases where untrusted users can trigger CallOPKG calls, and these users can enter an arbitrary URL

CVE-2018-20332 [HIGH] CWE-22 CVE-2018-20332: An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Readin An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Reading of arbitrary files is possible with /file?action=download&file= followed by a full pathname, and listing of arbitrary directories is possible with /file?action=download&dir= followed by a full pathname. This is related to plugin/controllers/file.py in

CVE-2021-38113 [MEDIUM] CWE-79 CVE-2021-38113: In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaSc In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor (i.e., bouqueteditor/api/addbouquet?name=) leads to Stored XSS.