PT-2014-2360 · Dotproject · Dotproject

Published 2014-10-20 · Updated 2017-08-29 · CVE-2012-5701

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dotProject versions prior to 2.1.7

Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This can be achieved via several parameters in different actions to "index.php", including the search string or where parameter in a contacts action, the dept id parameter in a departments action, the project id[] parameter in a project action, or the company id parameter in a system action. Additionally, this issue can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.

Recommendations For dotProject versions prior to 2.1.7, update to version 2.1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the parameters search string, where, dept id, project id[], and company id in their respective actions to minimize the risk of exploitation.

Exploit

Fix

CSRF

SQL injection

Weakness Enumeration

CWE-352

CWE-89

Related Identifiers

CVE-2012-5701

Affected Products

Dotproject

References · 8

• 🔥 https://exploit-db.com/exploits/38042 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23124 · Exploit
• 🔥 http://securityfocus.com/bid/56624 · Exploit
• 🔥 http://packetstormsecurity.com/files/118274/dotProject-2.1.6-Cross-Site-Scripting-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5701 · Security Note
• http://sourceforge.net/projects/dotproject/files/dotproject/dotProject%20Version%202.1.7 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80223 · Note
• http://osvdb.org/87625 · Note