Exploitation Summary
EIP tracks 2 public exploits for CVE-2014-7176. PoCs published by Portcullis.
AI-analyzed exploit summary This is a vulnerability writeup describing an authenticated blind SQL injection in Tuleap <= 7.4.99.5. The advisory details the affected parameters and URLs but does not include functional exploit code.
Description
SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lobal_txt parameter to plugins/docman.
Exploits (2)
This is a vulnerability writeup describing an authenticated blind SQL injection in Tuleap <= 7.4.99.5. The advisory details the affected parameters and URLs but does not include functional exploit code.
This exploit demonstrates an XML External Entity (XXE) injection vulnerability in Tuleap <= 7.2, allowing an authenticated attacker to read local system files (e.g., /etc/passwd) by uploading a maliciously crafted XML file via a multipart/form-data POST request.