PT-2004-2300 · Phpgroupware · Phpgroupware

James Bercegay · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1385

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: phpGroupWare versions 0.9.16.003 and earlier

Description: The issue allows remote attackers to gain sensitive information. This can be achieved through unexpected characters in the session ID, such as shell metacharacters, an invalid appname parameter to "preferences.php", or an invalid menuaction parameter to "index.php", which reveals the web server path in an error message.

Recommendations: For phpGroupWare versions 0.9.16.003 and earlier, consider restricting access to the "preferences.php" and "index.php" scripts until a fix is available. As a temporary workaround, avoid using invalid parameters such as appname and menuaction in the affected API endpoints.

Exploit

Fix

Related Identifiers

CVE-2004-1385

Affected Products

Phpgroupware

References · 6

• 🔥 http://gulftech.org/?node=research&article_id=00054-12142004 · Exploit
• 🔥 https://exploit-db.com/exploits/24847 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1385 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200501-08.xml · Patch, Vendor Advisory
• http://marc.info/?l=bugtraq&m=110312656029072&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18497 · Note