Description
SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a projectpdf action.
Exploits (1)
References (6)
Core 6
Core References
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/64943
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/102123
Exploit x_refsource_misc
http://packetstormsecurity.com/files/124777/Collabtive-1.1-SQL-Injection.html
Exploit exploit
x_refsource_exploit-db
http://www.exploit-db.com/exploits/30946
Patch x_refsource_misc
http://www.collabtive.o-dyn.de/blog/?p=621#more-621
Exploit mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Jan/72
Scores
EPSS
0.0170
EPSS Percentile
82.4%
Details
CWE
CWE-89
Status
published
Products (26)
o-dyn/collabtive
0.1
o-dyn/collabtive
0.2
o-dyn/collabtive
0.2.5
o-dyn/collabtive
0.3
o-dyn/collabtive
0.3.5
o-dyn/collabtive
0.3.6
o-dyn/collabtive
0.4
o-dyn/collabtive
0.4.5
o-dyn/collabtive
0.4.6
o-dyn/collabtive
0.4.7
... and 16 more
Published
Jan 21, 2014
Tracked Since
Feb 18, 2026