Achievo 1.3.4 - SQL Injection

ExploitDBExploitDB exploitWriteupEDB-10042

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a security advisory describing an SQL injection vulnerability in Achievo 1.3.4. It provides a technical description of the vulnerable code in classweekreport.inc and a URL demonstrating how to trigger a syntax error, but it does not include any executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a standard security advisory describing an SQL injection vulnerability in Achievo 1.3.4. It includes a technical description, a proof-of-concept URL, and the vulnerable code snippet. No backdoor, deceptive payload, or unrelated harmful behavior is present in the reviewed text.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
Languagesenglish
Target softwareAchievo
Attack typessql injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a security advisory containing a technical description of the vulnerability and a proof-of-concept URL that triggers an error, but it does not contain any code intended to exploit or scan for the vulnerability. It is a writeup.

exploits/php/webapps/10042.txt:1-126

Requirements

  • Attacker must be logged into Achievo.exploits/php/webapps/10042.txt:66

Observed behavior

  • The advisory describes a SQL injection vulnerability in the get_employee function of classweekreport.inc, where the $user_id variable is directly embedded in a SQL query without sanitization.exploits/php/webapps/10042.txt:73-80
  • The advisory provides a URL that triggers a database syntax error when browsed by a logged-in user, demonstrating the vulnerability.exploits/php/webapps/10042.txt:68-70
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Disclosure
SQL injection in Achievo dispatch.php via userid parameterThe advisory describes a legitimate SQL injection vulnerability (CVE-2009-2734) in the get_employee function of classweekreport.inc. The provided PoC URL demonstrates the vulnerability by injecting a single quote into the userid parameter.exploits/php/webapps/10042.txt:64-80
Proof Of Concept Url
/dispatch.php?atknodetype=reports.weekreport&atkaction=report&nameswitch=name&userid=%27&functionlevelswitch=all&startstatus=all&outputType=0&atkorderby=periodThe URL demonstrates the SQL injection by setting userid to a single quote, which would cause a syntax error in the vulnerable SQL query. This is a typical benign PoC for demonstrating SQL injection existence.exploits/php/webapps/10042.txt:68
Vulnerable Code
SELECT * FROM person WHERE status='active' AND id='$user_id'The advisory shows the vulnerable code where the $user_id variable is directly interpolated into the SQL query without sanitization, confirming the SQL injection vulnerability.exploits/php/webapps/10042.txt:73-80
Review boundaries

What the analysis did not establish

  • The artifact is a text advisory; no executable exploit or scanner code is present.
  • The advisory references an external URL for the full advisory, which was not fetched.
  • Only the text content of the advisory was reviewed; no external resources or referenced URLs were fetched or analyzed.
  • The review does not assess whether the described vulnerability could be used maliciously by a third party.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1