CVE-2009-2734

Achievo (before 1.4.0) is affected by a SQL injection in the dispatch.php path via the get_employee function. The vulnerability stems from the get_employee($user_id) code building a SQL query with the user-provided userid/user_id without proper sanitization: SELECT * FROM person WHERE status='act...

CVE-2009-3705

Achievo

CVE-2009-2734

SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...

CVE-2009-2733

CVE-2009-2733 concerns Achievo before version 1.4.0, which contains multiple cross-site scripting (XSS) vulnerabilities. Exploitation vectors include the scheduler title in the scheduler module and parameters such as atksearch[contractnumber], atksearch_AE_customer[customer], atksearchmode[contra...

Achievo < 1.4.0 Multiple Vulnerabilities

Binary data 5208.prm...

Achievo <= 1.3.4 SQL Injection

Exploit for unknown platform in category web applications ============================== Achievo = 1.3.4 SQL Injection ============================== 1. Vulnerability Information Class: SQL Injection Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2009-2734 2. Software Descriptio...

Achievo 1.3.4 - SQL Injection

Achievo 1.3.4 - SQL Injection Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in Achievo 1. Advisory Information Title: SQL Injection in Achievo Advisory ID: BONSAI-2009-0102 Advisory URL:...

Achievo 1.3.4 - SQL Injection

Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in Achievo 1. Advisory Information Title: SQL Injection in Achievo Advisory ID: BONSAI-2009-0102 Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/achievo-sql-injection-0102.txt Date published:...

Achievo 1.3.4 - Cross-Site Scripting

Achievo 1.3.4 - Cross-Site Scripting Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Achievo 1. Advisory Information Title: Multiple XSS in Achievo Advisory ID: BONSAI-2009-0101 Advisory URL:...

Achievo SQL Injection

Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in Achievo 1. Advisory Information Title: SQL Injection in Achievo Advisory ID: BONSAI-2009-0102 Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/achievo-sql-injection-0102.txt Date published:...

[BONSAI] SQL Injection in Achievo

Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in Achievo 1. Advisory Information Title: SQL Injection in Achievo Advisory ID: BONSAI-2009-0102 Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/achievo-sql-injection-0102.txt Date published:...

Achievo Cross Site Scripting

Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Achievo 1. Advisory Information Title: Multiple XSS in Achievo Advisory ID: BONSAI-2009-0101 Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/achievo-multiple-xss-0101.txt Date published:...

Achievo <= 1.3.4 xss

Exploit for unknown platform in category web applications ==================== Achievo = 1.3.4 xss ==================== Multiple XSS in Achievo 1. Advisory Information Title: Multiple XSS in Achievo Vendors contacted: Achievo Release mode: Coordinated release 2. Vulnerability Information Class:...

[BONSAI] XSS in Achievo - Customized XSS payload included

Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Achievo 1. Advisory Information Title: Multiple XSS in Achievo Advisory ID: BONSAI-2009-0101 Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/achievo-multiple-xss-0101.txt Date published:...

Achievo &lt;= 1.3.4 xss

No description provided by source. Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Achievo 1. Advisory Information Title: Multiple XSS in Achievo Advisory ID: BONSAI-2009-0101 Advisory URL:...

Achievo &lt;= 1.3.4 SQL Injection

No description provided by source. Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in Achievo 1. Advisory Information Title: SQL Injection in Achievo Advisory ID: BONSAI-2009-0102 Advisory URL:...

Achievo 1.3.4 - Cross-Site Scripting

Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Achievo 1. Advisory Information Title: Multiple XSS in Achievo Advisory ID: BONSAI-2009-0101 Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/achievo-multiple-xss-0101.txt Date published:...

Achievo 1.x - Multiple Cross-Site Scripting HTML Injection Vulnerabilities

Achievo 1.x - Multiple Cross-Site Scripting HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/36661/info Achievo is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML...

Achievo 1.x - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/36661/info Achievo is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site,...

Achievo 1.3.4 Remote File Inclusion

Achievo 1.3.4debugger.php Remote File Include Vulnerability Author : M3NW5 Homepage : http://www.indonesiancoder.com contach : [email protected] Location : INDONESIA Achievo 1.3.4 Information Vendor : http://www.achievo.org/ Scripts : http://www.achievo.org/download/ File : debugger.php...