Tuleap does not sanitize properly user inputs when constructing a SQL query for listing the most active projects.

Impact

An attacker could execute arbitrary SQL queries.
CVSSv2 score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitation

The page <tuleap_url>/top/mostactive.php is exploitable via the parameter offset.

The vulnerability can be demonstrated using this query:
<tuleap_url>/top/mostactive.php?offset=1 PROCEDURE analyse((select extractvalue(0,BENCHMARK(50000000,SHA1(1)))),1)%23
When the vulnerability is present, the query will take a large amount of time to be executed by the DBMS.

References

https://cwe.mitre.org/data/definitions/89.html
https://www.owasp.org/index.php/SQL_Injection
https://rateip.com/blog/sql-injections-in-mysql-limit-clause/