[UNIX] SQL Injection Vulnerability Found in phpGroupWareFrom: firstname.lastname@example.org
- Previous message: email@example.com: "[NEWS] Cisco Secure ACS Web Server has a Directory Traversal Issue (Additional details)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: firstname.lastname@example.org To: email@example.com Date: Sat, 6 Apr 2002 13:33:27 +0200 (CEST)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
SQL Injection Vulnerability Found in phpGroupWare
<http://www.phpgroupware.org/> phpGroupWare is a Groupware application
written in PHP. It provides a framework of applications like calendar,
ToDo list, notes, HR management, that come with phpGroupWare as well as an
API to write new applications. All data is stored in an SQL database. A
security vulnerability in the product allows remote attackers to inject
SQL code into the existing queries conducted by the product allowing him
full control of the database entries.
phpGroupWare version 0.9.12
phpGroupWare version 0.9.12-3.2 (Debian)
phpGroupWare version 0.9.14 RC2
phpGroupWare version 0.9.14-0.RC2.1 (Debian)
Go to the login page of a phpGroupWare installation. Enter:
fubar'; CREATE TABLE thistableshouldnotexist (a int); --
Enter the whole line. Don't forget the "'" after "fubar". The database
used for phpGroupWare should now have a new table.
The information has been provided by <mailto:firstname.lastname@example.org> Matthias
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: email@example.com
In order to subscribe to the mailing list, simply forward this email to: firstname.lastname@example.org
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.