Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam™  Beyond Security®  SecuriTeam™ Home  Ask the Team  Mailing Lists  Advertising Info  Blogs SecuriTeam™ in Your Inbox   E-mail this CVE-2010-0404 to a friend New vulnerability? New tool? Tell us	CVE-2010-0404 phpGroupWare SQL Injection and Local File Inclusion Vulnerabilities     Credit: The original article can be found at: http://www.vupen.com/english/advisories/2010/1145 Website Security Scan Code Vulnerability Test Network Assessment Tool Detect hidden vulnerabilities Exhaustive automated testing Real-time, continuous security Get guidance from professionals of internal or 3rd party code. scanning for your entire network    CVE-2010-0404 Details Check for CVE-2010-0404 Vulnerability Assessment and Management. Automated Pen Testing for 50 to 50,000 nodes beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * phpGroupWare version 0.9.16.015 and prior Immune Systems:  * phpGroupWare version 0.9.16.016 The first issue is caused by input validation errors in the "phpgwapi/inc/class.sessions_db.inc.php", "phpgwapi/inc/class.translation_sql.inc.php", "phpgwapi/inc/class.sessions_db.inc.php" and "phpgwapi/inc/class.auth_sql.inc.php" scripts when processing user-supplied parameters, which could be exploited by malicious people to conduct SQL injection attacks. The second vulnerability is caused by an input validation error in the "about.php" script when processing the "app" parameter, which could be exploited by attackers to include local files with the privileges of the web server. CVE Information: CVE-2010-0403 CVE-2010-0404 Disclosure Timeline: 2010-05-14 : Initial release  Comments on CVE-2010-0404:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Copyright © 1998-2010 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®