Achievo 1.4.2 - Persistent Cross-Site Scripting

Affected Platforms: Any running Achievo Severity: Medium – CVSS: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Vendor Status: New release available Achievo 1.4.3 Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerabilitypolicy.pdf Vulnerability Description: A permanent Cross Site Scriptin...

Sql injection

SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...

Remote file inclusion

PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the configatkroot parameter...

CVE-2009-2733

Multiple cross-site scripting XSS vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via 1 the scheduler title in the scheduler module, and the 2 atksearchcontractnumber, 3 atksearchAEcustomercustomer, 4 atksearchmodecontracttype, and possibly 5...

CVE-2009-2734

SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...

CVE-2009-3705

PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the configatkroot parameter...

CVE-2009-3705

PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the configatkroot parameter...

CVE-2009-2734

Achievo (before 1.4.0) is affected by a SQL injection in the dispatch.php path via the get_employee function. The vulnerability stems from the get_employee($user_id) code building a SQL query with the user-provided userid/user_id without proper sanitization: SELECT * FROM person WHERE status='act...

CVE-2009-2734

SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...

CVE-2009-2733

CVE-2009-2733 concerns Achievo before version 1.4.0, which contains multiple cross-site scripting (XSS) vulnerabilities. Exploitation vectors include the scheduler title in the scheduler module and parameters such as atksearch[contractnumber], atksearch_AE_customer[customer], atksearchmode[contra...

CVE-2009-2733

Multiple cross-site scripting XSS vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via 1 the scheduler title in the scheduler module, and the 2 atksearchcontractnumber, 3 atksearchAEcustomercustomer, 4 atksearchmodecontracttype, and possibly 5...

CVE-2009-2733

Multiple cross-site scripting XSS vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via 1 the scheduler title in the scheduler module, and the 2 atksearchcontractnumber, 3 atksearchAEcustomercustomer, 4 atksearchmodecontracttype, and possibly 5...

CVE-2009-2734

SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...

CVE-2009-3705

Achievo

CVE-2009-2734: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...

CVE-2009-2733: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via 1 the scheduler title in the scheduler module, and the 2 atksearchcontractnumber, 3 atksearchAEcustomercustomer, 4 atksearchmodecontracttype, and possibly 5...

CVE-2009-3705: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the configatkroot parameter...

Achievo < 1.4.0 Multiple Vulnerabilities

Binary data 5208.prm...

Achievo SQL Injection

Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in Achievo 1. Advisory Information Title: SQL Injection in Achievo Advisory ID: BONSAI-2009-0102 Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/achievo-sql-injection-0102.txt Date published:...

Achievo <= 1.3.4 SQL Injection

Exploit for unknown platform in category web applications ============================== Achievo = 1.3.4 SQL Injection ============================== 1. Vulnerability Information Class: SQL Injection Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2009-2734 2. Software Descriptio...