Sql injection

SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action...

Cross site scripting

Cross-site scripting XSS vulnerability in include.php in Achievo 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the field parameter...

CVE-2012-5866

CVE-2012-5866 is an XSS vulnerability in Achievo 1.4.5, caused by an input sanitation error in include.php when handling the HTTP GET parameter field. An attacker can inject arbitrary HTML/JavaScript into a user’s browser. A PoC demonstrates script execution via include.php?field=... The HTB advi...

CVE-2012-5865

SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action...

CVE-2012-5866

Cross-site scripting XSS vulnerability in include.php in Achievo 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the field parameter...

CVE-2012-5865

CVE-2012-5865 concerns Achievo 1.4.5 where a SQL injection flaw exists in the dispatch.php script via the GET parameter activityid in the stats action. The vulnerability can be exploited by remote authenticated users to inject arbitrary SQL commands into the database, with the PoC indicating the ...

Achievo 1.4.3 - Multiple Authorization Flaws

No description provided by source...

Achievo 1.4.3 - CSRF Vulnerability

No description provided by source...

Achievo 1.x Multiple Cross Site Scripting and HTML Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/36661/info Achievo is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the...

Achievo 1.4.2 - Arbitrary File Upload

No description provided by source...

Achievo 1.3.4 - Remote File Inclusion

No description provided by source. Achievo 1.3.4debugger.php Remote File Include Vulnerability Author : M3NW5 Homepage : http://www.indonesiancoder.com contach : [email protected] Location : INDONESIA Achievo 1.3.4 Information Vendor : http://www.achievo.org/ Scripts :...

Achievo <= 1.3.4 - SQL Injection

No description provided by source. Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in Achievo 1. Advisory Information Title: SQL Injection in Achievo Advisory ID: BONSAI-2009-0102 Advisory URL:...

Achievo 0.7/0.8/0.9 - Remote File Include Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5552/info Achievo includes a PHP script which is used to generate JavaScript class.atkdateattribute.js.php. This script employs a number of PHP includeonce statements to call code contained in function libraries and grab...

achievo 1.4.5 - Multiple Vulnerabilities

No description provided by source...

Achievo 1.4.3 - Multiple Web Vulnerabilities

No description provided by source. Title: ====== Achievo v1.4.3 - Multiple Web Vulnerabilities Date: ===== 2012-01-30 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=403 VL-ID: ===== 403 Introduction: ============= Achievo is a flexible web-based resource management too...

Achievo <= 1.3.4 xss

No description provided by source. Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Achievo 1. Advisory Information Title: Multiple XSS in Achievo Advisory ID: BONSAI-2009-0101 Advisory URL:...

Achievo <= 1.3.2 (fckeditor) Arbitrary File Upload Exploit

No description provided by source. ?php / ----------------------------------------------------------------- Achievo = 1.3.2 fckeditor Remote Arbitrary File Upload Exploit ----------------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....:...

Achievo 1.3.2 'atknodetype' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31326/info Achievo is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Achievo <= 1.3.4 Multiple Cross Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/35140/info Achievo is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the...

Multiple vulnerabilities in Achievo

Advisory ID: HTB23126 Product: Achievo Vendor: www.achievo.org Vulnerable Versions: 1.4.5 and probably prior Tested Version: 1.4.5 Vendor Notification: November 14, 2012 Public Disclosure: December 5, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79 CVE References:...