112 matches found
phpCollab 2.5 Multiple Vulnerabilities
Exploit for php platform in category web applications Product: phpCollab Vendor: phpCollab Team http://www.php-collab.org/ Vulnerable Version: 2.5 and probably prior versions Vendor Notification: 24 March 2011 Vulnerability Type: CSRF Cross-Site Request Forgery Risk level: Low Credit: High-Tech...
phpcollab 2.5 - Multiple Vulnerabilities
phpcollab 2.5 - Multiple Vulnerabilities Vulnerability ID: HTB22916 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpcollab.html Product: phpCollab Vendor: phpCollab Team http://www.php-collab.org/ Vulnerable Version: 2.5 and probably prior versions Vendor Notification: 24 March 2011...
phpcollab 2.5 - Multiple Vulnerabilities
Vulnerability ID: HTB22916 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpcollab.html Product: phpCollab Vendor: phpCollab Team http://www.php-collab.org/ Vulnerable Version: 2.5 and probably prior versions Vendor Notification: 24 March 2011 Vulnerability Type: CSRF Cross-Site Request...
phpCollab 2.5 XSRF / XSS / Path Disclosure
================================= Vulnerability ID: HTB22918 Reference: http://www.htbridge.ch/advisory/pathdisclosureinphpcollab.html Product: phpCollab Vendor: phpCollab Team http://www.php-collab.org/ Vulnerable Version: 2.5 and probably prior versions Vendor Notification: 24 March 2011...
Cross-site Request Forgery (CSRF) in phpCollab
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in phpCollab which can be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF in phpCollab 1.1 The vulnerability exists due to insufficient validation of the request origin in...
CVE-2008-4303
Multiple SQL injection vulnerabilities in phpCollab 2.5 rc3, 2.4, and earlier allow remote attackers to execute arbitrary SQL commands via the loginForm parameter to general/login.php, and unspecified other vectors...
CVE-2008-4305
Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...
CVE-2008-4304
general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSLCLIENTCERT environment variable. NOTE: in some environments, SSLCLIENTCERT always has a base64-encoded string value, which may...
Sql injection
Multiple SQL injection vulnerabilities in phpCollab 2.5 rc3, 2.4, and earlier allow remote attackers to execute arbitrary SQL commands via the loginForm parameter to general/login.php, and unspecified other vectors...
Design/Logic Flaw
general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSLCLIENTCERT environment variable. NOTE: in some environments, SSLCLIENTCERT always has a base64-encoded string value, which may...
Code injection
Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...
CVE-2008-4304
CVE-2008-4304 affects phpCollab 2.5 rc3 and older, where general/login.php can allow remote code execution via shell metacharacters in input related to SSL_CLIENT_CERT. The root cause is improper sanitization of the SSL_CLIENT_CERT usage in a shell command, enabling an attacker to run arbitrary c...
CVE-2008-4305
Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...
CVE-2008-4303
Multiple SQL injection vulnerabilities in phpCollab 2.5 rc3, 2.4, and earlier allow remote attackers to execute arbitrary SQL commands via the loginForm parameter to general/login.php, and unspecified other vectors...
CVE-2008-4305
CVE-2008-4305 affects phpCollab 2.5 rc3 and earlier. The issue is a static code injection in installation/setup.php, allowing remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI. The NVD entry confirms a static code injection vulnerability with i...
CVE-2008-4304
general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSLCLIENTCERT environment variable. NOTE: in some environments, SSLCLIENTCERT always has a base64-encoded string value, which may...
CVE-2008-4303
CVE-2008-4303 affects phpCollab 2.5 rc3, 2.4 and earlier. The vulnerability arises from unsanitized input in general/login.php via the loginForm parameter (and unspecified other vectors), enabling remote attackers to execute arbitrary SQL commands. The NVD entry lists the impact as remote SQL inj...
CVE-2008-4305: Improper Control of Generation of Code
Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...
CVE-2008-4304: Improper Neutralization of Special Elements used in an OS Command
general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSLCLIENTCERT environment variable. NOTE: in some environments, SSLCLIENTCERT always has a base64-encoded string value, which may...
CVE-2008-4303: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in phpCollab 2.5 rc3, 2.4, and earlier allow remote attackers to execute arbitrary SQL commands via the loginForm parameter to general/login.php, and unspecified other vectors...