Multiple vulnerabilities in ProjectSend



| Updated: 2020-11-09
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2015-2564
CVE-2014-9580
CVE-2014-9567
CWE-ID CWE-89
CWE-79
CWE-94
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Vulnerable software
 ProjectSend
Web applications / Other software

Vendor ProjectSend

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) SQL injection

EUVDB-ID: #VU40868

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2015-2564

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the id parameter to users-edit.php. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ProjectSend: 561

CPE2.3 External links

https://osvdb.org/show/osvdb/119169
https://packetstormsecurity.com/files/130691/ProjectSend-r561-SQL-Injection.html
https://seclists.org/fulldisclosure/2015/Mar/30
https://www.exploit-db.com/exploits/36303
https://www.itas.vn/news/itas-team-found-out-a-SQL-Injection-vulnerability-in-projectsend-r561-76.html
https://www.securityfocus.com/archive/1/534832/100/0/threaded


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Cross-site scripting

EUVDB-ID: #VU40963

Risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2014-9580

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: Yes

Description

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in ProjectSend (formerly cFTP) r561 when processing Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ProjectSend: 561

CPE2.3 External links

https://packetstormsecurity.com/files/129666
https://www.exploit-db.com/exploits/35582
https://exchange.xforce.ibmcloud.com/vulnerabilities/99550


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Code Injection

EUVDB-ID: #VU40965

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2014-9567

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ProjectSend: 100 - 561

CPE2.3 External links

https://osvdb.org/show/osvdb/116469
https://packetstormsecurity.com/files/129759/ProjectSend-Arbitrary-File-Upload.html
https://www.exploit-db.com/exploits/35424
https://www.exploit-db.com/exploits/35660
https://exchange.xforce.ibmcloud.com/vulnerabilities/99548


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###