dotProject 2.1.9 - SQL Injection

Exploit Title: dotProject 2.1.9 - Multiple Sql Injection Poc Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://dotproject.net Software Link: https://github.com/dotproject/dotProject/archive/v2.1.9.zip Version: 2.1.9 Category: Webapps Tested on: Xampp for Windows Software...

CVE-2014-8554

SQL injection vulnerability in the mcprojectgetattachments function in api/soap/mcprojectapi.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the projectid parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609...

CVE-2014-8554

SQL injection vulnerability in the mcprojectgetattachments function in api/soap/mcprojectapi.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the projectid parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609...

CVE-2014-8554: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the mcprojectgetattachments function in api/soap/mcprojectapi.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the projectid parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609...

mantisbt: sql injection

Edwin Gozeling and Wim Visser discovered that when the projectid parameter of the SOAP-request starts with the integer of a project to which the user or anonymous is authorized, the ENTIRE value will become the first item of $tprojects. As this value is concatenated in the SQL statement,...

CVE-2012-5701: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 searchstring or 2 where parameter in a contacts action, 3 deptid parameter in a departments action, 4 projectid parameter in a project action, or...

CVE-2012-0030

Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified projectid URI parameter...

CVE-2012-0030

Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified projectid URI parameter...

CVE-2012-0030: Undefined Security Weakness

Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified projectid URI parameter...

CVE-2011-2938

Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...

CVE-2011-2938: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...

Sql injection

Multiple SQL injection vulnerabilities in index.php in PHPAccounts 0.5 allow remote attackers to execute arbitrary SQL commands via the 1 OutgoingTypeID, 2 OutgoingID, 3 ProjectID, 4 ClientID, 5 InvoiceID, or 6 VendorID parameter...

CVE-2007-3345

Multiple SQL injection vulnerabilities in index.php in PHPAccounts 0.5 allow remote attackers to execute arbitrary SQL commands via the 1 OutgoingTypeID, 2 OutgoingID, 3 ProjectID, 4 ClientID, 5 InvoiceID, or 6 VendorID parameter...

CVE-2005-4822: Undefined Security Weakness

SQL injection vulnerability in projects/project-edit.asp in Digger Solutions Intranet Open Source IOS version 2.7.2 allows remote attackers to execute arbitrary SQL commands via the projectid parameter...

CVE-2004-1383: Undefined Security Weakness

Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the 1 order, 2 projectid, 3 promain, or 4 hoursid parameters to index.php or 5 ticketid to viewticketdetails.php...