|
Description
|
|
Multiple vulnerabilities have been discovered in Collabtive, which can be exploited by malicious users to conduct script insertion and SQL injection attacks and compromise a vulnerable system and by malicious people to conduct cross-site scripting attacks.
1) The manageuser.php script improperly verifies uploaded Avatar files and this can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
2) Input passed via the "userto" GET parameter to managechat.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
3) Input passed via the "title" POST parameter to managemessage.php (when "action" is set to "edit" and "id" is set) is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.
The vulnerabilities #1, #2, and #3 are confirmed in versions 1.0, 1.1, and 1.2. Other versions may also be affected.
4) Input passed via the "folder" GET parameter to manageajax.php (when "action" is set to "fileview_list" and "id" is set) is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
5) Input passed via the "desc" POST parameter to admin.php (when "action" is set to "addpro", "neverdue" is set to "neverdue", "assignme" is set to "1", and "name", "budget", and "assignto%5B%5D" are set) is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.
For more information:
SA56329
The vulnerabilities #4 and #5 are confirmed in version 1.2. Other versions may also be affected.
|
