[UNIX] SQL Injection Vulnerability Found in phpGroupWare

From: support@securiteam.com
Date: 04/06/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Sat,  6 Apr 2002 13:33:27 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  SQL Injection Vulnerability Found in phpGroupWare
------------------------------------------------------------------------

SUMMARY

 <http://www.phpgroupware.org/> phpGroupWare is a Groupware application
written in PHP. It provides a framework of applications like calendar,
ToDo list, notes, HR management, that come with phpGroupWare as well as an
API to write new applications. All data is stored in an SQL database. A
security vulnerability in the product allows remote attackers to inject
SQL code into the existing queries conducted by the product allowing him
full control of the database entries.

DETAILS

Vulnerable systems:
phpGroupWare version 0.9.12
phpGroupWare version 0.9.12-3.2 (Debian)

Immune systems:
phpGroupWare version 0.9.14 RC2
phpGroupWare version 0.9.14-0.RC2.1 (Debian)

Example:
Go to the login page of a phpGroupWare installation. Enter:
fubar'; CREATE TABLE thistableshouldnotexist (a int); --

Enter the whole line. Don't forget the "'" after "fubar". The database
used for phpGroupWare should now have a new table.

ADDITIONAL INFORMATION

The information has been provided by <mailto:mjordan@code-fu.de> Matthias
Jordan.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages