Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in dotProject 2.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 the inactive parameter in a tasks action, 2 the date parameter in a calendar dayview action, 3 the callback parameter in a public calendar action,...

CVE-2008-3887

Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow 1 remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and 2 remote authenticated administrators to execute arbitrary SQL commands via the userid parameter in a viewus...

CVE-2008-3886

CVE-2008-3886: dotProject 2.1.2 contains multiple XSS flaws in index.php, exploitable via (1) inactive (tasks action), (2) date (calendar day_view), (3) callback (public calendar), or (4) type (ticketsmith). The issue arises from reflected/scriptable input in these parameters, enabling remote inj...

CVE-2008-3887

CVE-2008-3887 affects dotProject 2.1.2, specifically SQL injection in index.php. The vulnerabilities allow remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and remote authenticated administrators to do so via the user_id parameter in a viewu...

dotproject-sqlxss.txt

======================================================================= . .. | | / / | | | | / \ / / /\ / / \ | | | / / \ /\ \| | / // / /\ \ / / / // http://wwwlowsec.org ======================================================================== Author: C1c4Tr1Z Date: 28/08/08...