Project Management Program Collabtive v0.6.1 Multiple Vulnerabilities

AUTHOR: HipHop

Demo address:Demo Url

After the Administrator logs in
Xss is full in the background, but this is not uncommon.
Here is a simple test on whether the stolen cookie can be bypass auth.
The answer is yes, but his authentication uses session.
Assume that all cookie users close the browser.

Injection also exists in the background
Managechat. php
$ Start = $ _ COOKIE ["$ cook"];
$ Sel = mysql_query ("SELECT * FROM chat WHERE ufrom_id IN ($ userid, $ userto_id) AND userto_id IN ($ userid, $ userto_id) AND time> $ start ORDER by time ASC ");

Cookie Injection




DEMO XSS COOKIE AUTH BYPASS