Description

SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileview_list action to manageajax.php.

Remediation

References

CVE-2014-3246

Related Vulnerabilities

WordPress Plugin WP Auctions 'wpa_id' Parameter SQL Injection (1.8.8)

WordPress Plugin Media File Renamer-Auto & Manual Rename Cross-Site Request Forgery (5.2.5)

PostgreSQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-3167)

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Cross-Site Request Forgery (1.13.4)

WordPress Plugin xPinner Lite Multiple Vulnerabilities (2.2)

Severity

Medium

Classification

CVE-2014-3246 CWE-138

Tags

Missing Update Known Vulnerabilities