CVE-2013-6872

Exp

SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a projectpdf action.

Published: 2014-01-21 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]

NVD Status：Modified，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2013-6872

EPSS CVSS CWE Exploit-DB Affected OS Tracker

Conclusion & alert: CVE-2013-6872 is rated High Exploit Risk (70.6/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 2.46%). Core evidence: 5 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2013-6872

EDB-ID	Source	Kind	Published	Link
30946	exploit_db	edb	2014-01-15	Exploit-DB ↗
—	nvd_ref	exploit_tag		Exploit-DB ↗
—	nvd_ref	exploit_tag		Exploit-DB ↗
—	nvd_ref	exploit_tag		Exploit-DB ↗
—	nvd_ref	exploit_tag		Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2013-6872

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	1.70%	2.46%	+0.76%
2	2026-03-13	3.07%	1.70%	-1.38%
3	2025-09-06	—	3.07%	—

Full EPSS history (11 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2013-6872

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.5	2.0	MEDIUM	`AV:N/AC:L/Au:S/C:P/I:P/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:S) A single authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	8.0	6.4	[email protected]

Weakness enumeration for CVE-2013-6872

CWE-89 MITRE ↗

OS Trackers for CVE-2013-6872

vendor	priority	summary	link
`ubuntu`	medium	CVE-2013-6872 medium priority: Ubuntu including 1 source packages (collabtive), 13 status rows across 13 suites (lucid, precise, quantal, raring, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): not-affected 5, ignored 4, DNE 3, released 1.	https://ubuntu.com/security/CVE-2013-6872

Affected software / configurations for CVE-2013-6872

Vendor	Product	Version	Raw CPE
o-dyn	collabtive	<= 1.1	cpe:2.3:a:o-dyn:collabtive::::::::
o-dyn	collabtive	0.1	cpe:2.3:a:o-dyn:collabtive:0.1:::::::*
o-dyn	collabtive	0.2	cpe:2.3:a:o-dyn:collabtive:0.2:::::::*
o-dyn	collabtive	0.2.5	cpe:2.3:a:o-dyn:collabtive:0.2.5:::::::*
o-dyn	collabtive	0.3	cpe:2.3:a:o-dyn:collabtive:0.3:::::::*
o-dyn	collabtive	0.3.5	cpe:2.3:a:o-dyn:collabtive:0.3.5:::::::*
o-dyn	collabtive	0.3.6	cpe:2.3:a:o-dyn:collabtive:0.3.6:::::::*
o-dyn	collabtive	0.4	cpe:2.3:a:o-dyn:collabtive:0.4:::::::*
o-dyn	collabtive	0.4.5	cpe:2.3:a:o-dyn:collabtive:0.4.5:::::::*
o-dyn	collabtive	0.4.6	cpe:2.3:a:o-dyn:collabtive:0.4.6:::::::*
o-dyn	collabtive	0.4.7	cpe:2.3:a:o-dyn:collabtive:0.4.7:::::::*
o-dyn	collabtive	0.4.8	cpe:2.3:a:o-dyn:collabtive:0.4.8:::::::*
o-dyn	collabtive	0.4.9	cpe:2.3:a:o-dyn:collabtive:0.4.9:::::::*
o-dyn	collabtive	0.4.9.1	cpe:2.3:a:o-dyn:collabtive:0.4.9.1:::::::*
o-dyn	collabtive	0.5.1	cpe:2.3:a:o-dyn:collabtive:0.5.1:::::::*
o-dyn	collabtive	0.5.5	cpe:2.3:a:o-dyn:collabtive:0.5.5:::::::*
o-dyn	collabtive	0.6	cpe:2.3:a:o-dyn:collabtive:0.6:::::::*
o-dyn	collabtive	0.6.1	cpe:2.3:a:o-dyn:collabtive:0.6.1:::::::*
o-dyn	collabtive	0.6.2	cpe:2.3:a:o-dyn:collabtive:0.6.2:::::::*
o-dyn	collabtive	0.6.3	cpe:2.3:a:o-dyn:collabtive:0.6.3:::::::*
o-dyn	collabtive	0.6.4	cpe:2.3:a:o-dyn:collabtive:0.6.4:::::::*
o-dyn	collabtive	0.6.5	cpe:2.3:a:o-dyn:collabtive:0.6.5:::::::*
o-dyn	collabtive	0.7	cpe:2.3:a:o-dyn:collabtive:0.7:::::::*
o-dyn	collabtive	0.7.5	cpe:2.3:a:o-dyn:collabtive:0.7.5:::::::*
o-dyn	collabtive	0.7.6	cpe:2.3:a:o-dyn:collabtive:0.7.6:::::::*
o-dyn	collabtive	1.0	cpe:2.3:a:o-dyn:collabtive:1.0:::::::*

References for CVE-2013-6872

URL	Tags
http://osvdb.org/102123
http://packetstormsecurity.com/files/124777/Collabtive-1.1-SQL-Injection.html	Exploit
http://seclists.org/fulldisclosure/2014/Jan/72	Exploit
http://www.collabtive.o-dyn.de/blog/?p=621#more-621	Patch
http://www.exploit-db.com/exploits/30946	Exploit
http://www.securityfocus.com/bid/64943	Exploit

cvelogic Threat Intelligence