ACollab as described by its vendor is an accessible, open source, multi-group, Web-based collaborative work environment. ACollab is available as a standalone collaborative work environment that will run on its own. ACollab is ideal for groups working at a distance developing documentation, collaborating on research, or writing joint papers. All of the parameters are sanitized correctly before being used in SQL queries else of the POST parameters 'login' and 'password' in the 'sign_in.php' page. These parameters can be used for injecting arbitrary SQL queries; the 'login' parameter is single quoted and the 'password' parameter is single parenthesized, single quoted. The ACollab CMS uses two mechanism for authentication. One for master admin user which is based on a hard coded username/password initialized in the installation process. And a DB-based authentication for all other users, including the group administrators which can add/remove/edit all posts and news and ... from forums and first screen of the website. The second authentication mechanism can be bypassed. Go to the sign in page at 'victim.net/ACollab/sign_in.php' and use the following vectors for injecting your desired SQL query, namely $Q: - In the Username field (login POST parameter): ' or $Q or ''=' - In the Passwrod field (password POST parameter): ' or $Q or ''=' Go to the sign in page at 'victim.net/ACollab/sign_in.php' and use the following vectors for bypassing the authentication: - In the Username field (login POST parameter): ' or 1=1 or ''=' - In the Passwrod field (password POST parameter): ' or 1=1 or ''='