Exploit-DB #33475
Description: dotProject 2.1.3 - Multiple SQL Injections / HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-07
Author: Justin C. Klein Keane

Exploit:
source: https://www.securityfocus.com/bid/37669/info

dotProject is prone to multiple SQL-injection and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

The attacker may exploit the SQL-injection issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

dotProject 2.1.3 is vulnerable; other versions may also be affected.


== Company ===
The company creation screen fails to filter form details before creating
a new company.

Proof of Concept
1.  Log into dotProject as a user with privileges to create a new company
2.  Click the &#039;Companies&#039; link in the top navigation bar
3.  Click the &#039;new company&#039; button in the upper right
4.  Fill in "<script>alert(&#039;xss&#039;);</script>" for each field except for
phone, phone2, and fax.  These fields restrict the input size so simply
put "<script>alert(&#039;1&#039;);</script>" in these fields.
5.  Click the &#039;submit&#039; button in the lower right hand corner
6.  On the resulting screen the company name XSS will appear.
7.  To view the other company XSS attacks browse to
index.php?m=companies&a=view&company_id=X where &#039;X&#039; is the id of the new
company.  Alternatively you can click on the &#039;Projects&#039; link in the top
navigation then the &#039;new project&#039; button in the upper right.  Create a
new project, selecting the newly created company, which will appear as a
blank choice in the company drop down list.  Save the project and then
in the project list click on the company name.

Impact
Any user with the permissions to create new companies can expose other
users of dotProject to XSS attacks.

== Project ===
The project creation screen fails to filter form details before creating
a new project.

Proof of Concept
1.  Log into dotProject as a user with privileges to create a new project
2.  Click the &#039;Projects&#039; link in the top navigation bar
3.  Click the &#039;new project&#039; button in the upper right
4.  Fill in "<script>alert(&#039;xss&#039;);</script>" for the &#039;Project Name&#039;,
&#039;URL&#039;, &#039;Starting URL&#039;, and &#039;Description&#039; fields
5.  Click the &#039;submit&#039; button in the lower right hand corner
6.  On the resulting screen the project name XSS will appear.
7.  To view the other project XSS attacks browse to
index.php?m=projects&a=view&project_id=X where &#039;X&#039; is the id of the new
project.

Impact
Any user with the permissions to create new projects can expose other
users of dotProject to XSS attacks.

== Task ===
The task creation screen fails to filter form details before creating a
new task.

Proof of Concept
1.  Log into dotProject as a user with privileges to create a task
2.  Click the &#039;Projects&#039; link in the top navigation bar
3.  Click on a project name to which the user account has permissions
4.  Click the &#039;new task&#039; button in the upper right
5.  Fill in "<script>alert(&#039;xss&#039;);</script>" for the &#039;Task Name&#039;, &#039;Web
Address&#039;, &#039;Description&#039;, and &#039;Description&#039; fields
6.  Click on the &#039;Dates&#039; tab and select an appropriate date
7.  Click the &#039;save&#039; button in the lower right hand corner
8.  On the resulting screen the task name XSS will appear.
9.  To view the other task summary XSS attacks browse to
index.php?m=tasks&a=view&task_id=X where &#039;X&#039; is the id of the new task.

Impact
Any user with the permissions to create new tasks can expose other users
of dotProject to XSS attacks.

== Task Log ===
The task log creation screen fails to filter form details before
creating a new task log.

Proof of Concept
1.  Log into dotProject as a user with privileges to create a task
2.  Click the &#039;Tasks&#039; link in the top navigation bar
3.  Click on a task name to which the user account has permissions
4.  Click the &#039;New Log&#039; tab
5.  Fill in "<script>alert(&#039;xss&#039;);</script>" for the &#039;Summary&#039;, and
&#039;Description&#039; fields, enter ""><script>alert(&#039;log url&#039;);</script>" for
the &#039;URL&#039; field
6.  Click the &#039;update task&#039; button in the lower right hand corner
7.  On the resulting screen the task name XSS will appear.
8.  To view the other task log XSS attacks browse to
index.php?m=tasks&a=view&task_id=X where &#039;X&#039; is the id of the task.

Impact
Any user with the permissions to create new task logs (virtually all
dotProject users) can expose other users of dotProject to XSS attacks.

== Files ===
The file attachment screen fails to filter form details before creating
a new file attachment.

Proof of Concept
1.  Log into dotProject as a user with privileges to create a file
2.  Click the &#039;Files&#039; link in the top navigation bar
3.  Click on a &#039;new folder&#039; button in the upper right
4.  Fill in "<script>alert(&#039;xss&#039;);</script>" for the &#039;Folder Name&#039;, and
&#039;Description&#039; fields
5.  Click on the &#039;new file&#039; button in the upper right
6.  Observer the &#039;Folder name&#039; XSS
7.  Fill in "<script>alert(&#039;xss&#039;);</script>" for the &#039;Description&#039; field
and choose a file to upload
8.  Click the &#039;submit&#039; button in the lower right hand corner
9.  On the resulting screen the file description XSS will appear.

Impact
Any user with the permissions to create new files can expose other users
of dotProject to XSS attacks.

== Events ===
The events screen fails to filter form details before creating a new even