CVE-2010-0403

phpGroupWare < 0.9.16.016 - Remote Code Execution via about.php app Parameter

Title source: llm
STIX 2.1

Description

Directory traversal vulnerability in about.php in phpGroupWare (phpgw) before 0.9.16.016 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the app parameter.

References (11)

Core 11
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1146
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1145
Patch, Vendor Advisory x_refsource_confirm
http://download.phpgroupware.org/
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/58657
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/40167
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/511299/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/39731
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2010/dsa-2046
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/39665

Scores

EPSS 0.0198
EPSS Percentile 78.1%

Details

CWE
CWE-22
Status published
Products (11)
phpgroupware/phpgroupware 0.9.16
phpgroupware/phpgroupware 0.9.16.000
phpgroupware/phpgroupware 0.9.16.001
phpgroupware/phpgroupware 0.9.16.002
phpgroupware/phpgroupware 0.9.16.003
phpgroupware/phpgroupware 0.9.16.005
phpgroupware/phpgroupware 0.9.16.010
phpgroupware/phpgroupware 0.9.16.011
phpgroupware/phpgroupware 0.9.16.012
phpgroupware/phpgroupware 0.9.16.014
... and 1 more
Published May 19, 2010
Tracked Since Feb 18, 2026