CVE-2020-8866

MEDIUM

Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-8866 has a selected CVSS score of 6.5 (medium); EIP currently links 2 catalogued exploits.

Description

This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within add.php. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10125.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
2

Affected products and versions

1
ProductSourceVersion range

Groupware Webmail Edition

Browse Horde / Groupware Webmail Edition
CVE List5.2.22affected

Proofs of concept

2

Catalogued exploits

ExploitDBHorde Groupware Webmail Edition 5.2.22 - PHP File InclusionExploitDB exploitby Andrea CardaciNot analyzed1 file

linked to 2 vulnerabilities

ExploitDB
PoC details
ExploitDBHorde Groupware Webmail Edition 5.2.22 - PHAR LoadingExploitDB exploitby Andrea CardaciNot analyzed1 file

linked to 2 vulnerabilities

ExploitDB
PoC details

References

4