The script  CVE-2024-370X_parche_seguridad.sh  resolves the following vulnerabilities reported by INCIBE,
    for OpenGnsys version 1.1.1d and earlier.


    * CVE-2024-3704: SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). 
    This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve 
    all the information stored in the database.

    * CVE-2024-3705: unrestricted file upload vulnerability in OpenGnsys affecting version 1.1.1d (Espeto).
    This vulnerability allows an attacker to send a POST request to the endpoint '/opengnsys/images/M_Icons.php' 
    modifying the file extension, due to lack of file extension verification, resulting in a webshell injection.

    * CVE-2024-3706: information exposure vulnerability in OpenGnsys affecting version 1.1.1d (Espeto).
    This vulnerability allows an attacker to view a php backup file (controlaccess.php-LAST) where database credentials are stored.

    * CVE-2024-3707: information exposure vulnerability in OpenGnsys affecting version 1.1.1d (Espeto).
    This vulnerability allows an attacker to enumerate all files in the web tree by accessing a php file.

The archive tgz contains the script CVE-2024-370X_parche_seguridad.sh and the folder "files" with some files that need to be updated.
    It is necessary to leave the script in the same directory as the "files" folder.  

A backup copy of the modified or deleted files will be stored in /root/BACKUP-CVE-2024-370X.
