CVE-2010-4269
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL commands via the chatstart[USERTOID] cookie in a pull action.
Informations du CVE
Faiblesses connexes
| Nom de la faiblesse | Source | |
|---|---|---|
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | [email protected] |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 15381
Date de publication : 2010-10-31 23h00 +00:00
Auteur : Anatolia Security
EDB Vérifié : No
ANATOLIA SECURITY ADVISORY
---------------------------
### ADVISORY INFO ###
+ Title: Collabtive SQL Injection Vulnerability
+ Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-004.txt
+ Advisory ID: 2010-004
+ Version: 0.65
+ Date: 12/10/2010
+ Impact: Improper Neutralization of Special Elements used in an SQL Command
+ CWE-ID: 89
+ Credit: Anatolia Security
### VULNERABLE PRODUCT ###
+ Description: "Collabtive provides a web based platform to bring the project
management process and documentation online. Collabtive is an open source solution
with features and functionality similar to proprietary software such as BaseCamp."
+ Homepage: http://www.collabtive.com
### VULNERABILITY DETAILS ###
+ Description: Collabtive has "union" type SQL injection vulnerability. In "managechat.php" when the value of parameter "actions" equal to "pull"
application gets value of the cookie named like chatstart[USERTOID]. Application apply mysql_real_escape_string function to same variable but
include it without quotes. So mysql_real_escape_string function can't provide any security in this case. Attacker can exploit this vulnerability
for executing arbitrary sql codes.
+ Exploit/POC:
Set up cookie value to payload (*) and visit "managechat.php?action=pull".
(*) Payload: 1286742168 AND 1337=9 union select 1,2,3,4,5,6,concat_ws(0x3a,mailuser,mailpass) from settings limit 1--++owned
Products Mentioned
Configuraton 0
O-dyn>>Collabtive >> Version 0.6.5
- O-dyn>>Collabtive >> Version 0.6.5 (Open CPE detail)
Références
2025©
tesweb SA
