CVE:CVE-2013-6872
CNNVD:CNNVD-201401-402
Collabtive是一套基于Web的项目管理系统。该系统提供项目管理、文件管理、时间跟踪等功能。
Collabtive 1.1及之前的版本中的managetimetracker.php脚本存在SQL注入漏洞。远程攻击者可借助projectpdf操作中的‘id’参数利用该漏洞执行任意SQL命令。
solution:Upgrade o-dyn collabtive to a higher version than 1.1,0.1,0.2,0.2.5,0.3,0.3.5,0.3.6,0.4,0.4.5,0.4.6,0.4.7,0.4.8,0.4.9,0.4.9.1,0.5.1,0.5.5,0.6,0.6.1,0.6.2,0.6.3,0.6.4,0.6.5,0.7,0.7.5,0.7.6,1.0,and avoid the version (,1.1],0.1,0.2,0.2.5,0.3,0.3.5,0.3.6,0.4,0.4.5,0.4.6,0.4.7,0.4.8,0.4.9,0.4.9.1,0.5.1,0.5.5,0.6,0.6.1,0.6.2,0.6.3,0.6.4,0.6.5,0.7,0.7.5,0.7.6,1.0