0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Collabtive SQL Injection Vulnerability
[====================================== Collabtive SQL Injection Vulnerability ====================================== ### ADVISORY INFO ### + Title: Collabtive SQL Injection Vulnerability + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-004.txt + Advisory ID: 2010-004 + Version: 0.65 + Date: 12/10/2010 + Impact: Improper Neutralization of Special Elements used in an SQL Command + CWE-ID: 89 + Credit: Anatolia Security ### VULNERABLE PRODUCT ### + Description: "Collabtive provides a web based platform to bring the project management process and documentation online. Collabtive is an open source solution with features and functionality similar to proprietary software such as BaseCamp." + Homepage: http://www.collabtive.com ### VULNERABILITY DETAILS ### + Description: Collabtive has "union" type SQL injection vulnerability. In "managechat.php" when the value of parameter "actions" equal to "pull" application gets value of the cookie named like chatstart[USERTOID]. Application apply mysql_real_escape_string function to same variable but include it without quotes. So mysql_real_escape_string function can't provide any security in this case. Attacker can exploit this vulnerability for executing arbitrary sql codes. + Exploit/POC: Set up cookie value to payload (*) and visit "managechat.php?action=pull". (*) Payload: 1286742168 AND 1337=9 union select 1,2,3,4,5,6,concat_ws(0x3a,mailuser,mailpass) from settings limit 1--++owned # 0day.today [2024-12-25] #