phpGroupWare SQL Injection and Local File Inclusion Vulnerabilities
1 Jul. 2010
Summary
Multiple vulnerabilities have been identified in phpGroupWare, which could be exploited by remote attackers to inject SQL queries or disclose sensitive information.
Vulnerable Systems:
* phpGroupWare version 0.9.16.015 and prior
Immune Systems:
* phpGroupWare version 0.9.16.016
The first issue is caused by input validation errors in the "phpgwapi/inc/class.sessions_db.inc.php", "phpgwapi/inc/class.translation_sql.inc.php", "phpgwapi/inc/class.sessions_db.inc.php" and "phpgwapi/inc/class.auth_sql.inc.php" scripts when processing user-supplied parameters, which could be exploited by malicious people to conduct SQL injection attacks.
The second vulnerability is caused by an input validation error in the "about.php" script when processing the "app" parameter, which could be exploited by attackers to include local files with the privileges of the web server.
