|
|
| |
|
| |
phpgroupware: missing filename sanitizing, SQL injection
| Package(s): | phpgroupware |
CVE #(s): | CAN-2004-0016
CAN-2004-0017
|
| Created: | January 9, 2004 |
Updated: | January 14, 2004 |
| Description: |
The authors of phpgroupware, a web based groupware system written in PHP,
discovered several vulnerabilities. The Common Vulnerabilities and
Exposures project identifies the following problems:
CAN-2004-0016: In the "calendar" module, "save extension" was not enforced
for holiday files. As a result, server-side php scripts may be placed in
directories that then could be accessed remotely and cause the webserver to
execute those. This was resolved by enforcing the extension ".txt" for
holiday files.
CAN-2004-0017: Some SQL injection problems (non-escaping of values used in
SQL strings) the "calendar" and "infolog" modules. |
| Alerts: |
|
( Log in to post comments)
|
|
|