Description
Multiple SQL injection vulnerabilities in phpGroupWare (phpgw) before 0.9.16.016 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) class.sessions_db.inc.php, (2) class.translation_sql.inc.php, or (3) class.auth_sql.inc.php in phpgwapi/inc/.
References (9)
Core 9
Core References
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1146
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1145
Patch, Vendor Advisory x_refsource_confirm
http://download.phpgroupware.org/
Patch mailing-list
x_refsource_mlist
http://lists.gnu.org/archive/html/phpgroupware-users/2010-05/msg00004.html
Patch x_refsource_confirm
http://forums.phpgroupware.org/index.php?t=msg&th=98662&start=0&rid=0
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/511299/100/0/threaded
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/39731
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2010/dsa-2046
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/39665
Scores
EPSS
0.0233
EPSS Percentile
81.7%
Details
CWE
CWE-89
Status
published
Products (11)
phpgroupware/phpgroupware
0.9.16
phpgroupware/phpgroupware
0.9.16.000
phpgroupware/phpgroupware
0.9.16.001
phpgroupware/phpgroupware
0.9.16.002
phpgroupware/phpgroupware
0.9.16.003
phpgroupware/phpgroupware
0.9.16.005
phpgroupware/phpgroupware
0.9.16.010
phpgroupware/phpgroupware
0.9.16.011
phpgroupware/phpgroupware
0.9.16.012
phpgroupware/phpgroupware
0.9.16.014
... and 1 more
Published
May 19, 2010
Tracked Since
Feb 18, 2026