CVE-2014-3246

Collabtive 1.2 - Authenticated SQL Injection via Folder Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-3246. PoCs published by Deepak Rathore.

AI-analyzed exploit summary This is a writeup detailing a SQL injection vulnerability in Collabtive 1.12, where the 'folder' parameter in 'manageajax.php' is vulnerable to SQLi. The proof of vulnerability is demonstrated via an error-based SQL injection payload.

Description

SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileview_list action to manageajax.php.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Deepak Rathore · textwebappsphp
https://www.exploit-db.com/exploits/33249

This is a writeup detailing a SQL injection vulnerability in Collabtive 1.12, where the 'folder' parameter in 'manageajax.php' is vulnerable to SQLi. The proof of vulnerability is demonstrated via an error-based SQL injection payload.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Collabtive 1.12
Auth required
Prerequisites: Authenticated access to the Collabtive application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/33249
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/67287

Scores

EPSS 0.0133
EPSS Percentile 67.6%

Details

CWE
CWE-89
Status published
Products (1)
o-dyn/collabtive 1.2
Published May 13, 2014
Tracked Since Feb 18, 2026