phpGroupWare Main Screen Message Lets Remote Authenticated Administrators Inject HTML Code
|
|
SecurityTracker Alert ID: 1014832
|
|
SecurityTracker URL: http://securitytracker.com/id?1014832
|
|
CVE Reference: CVE-2005-2761
(Links to External Site)
|
Updated: Jun 8 2008
|
Original Entry Date: Sep 1 2005
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 0.9.16.000
|
Description: A vulnerability was reported in phpGroupWare. A remote user with administrative privileges can inject arbitrary HTML.
A remote authenticated administrator can edit the main screen message to include arbitrary HTML. When a target user views the affecte
site, arbitrary scripting code will be executed by the target user's browser. The code will originate from the site running the
phpGroupWare software and will run in the security context of that site. As a result, the code will be able to access the target
user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target
user via web form to the site, or take actions on the site acting as the target user.
|
Impact: A remote administrative user can inject HTML code to be executed by a target user's browser when the target user visits the affected site.
|
Solution: The vendor has issued a fixed version (0.9.16.008), available at:
http://downloads.phpgroupware.org/
|
Vendor URL: www.phpgroupware.org/ (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 1 Sep 2005 01:06:01 -0400
Subject: phpGroupWare vulnerability
|
http://savannah.gnu.org/bugs/?func=detailitem&item_id=13863
> bug #13863 overview: Main screen message allows for potential security risk
> 0.9.16.000 release
> When editing the main screen message from the admin pages, it appears to be possible
> to include *any* HTML that you like, which means that this could potentially be
> abused, either with javascript or other code embedded in the message.
Fixed in 0.9.16.007.
CVE: CAN-2005-2761
|
|
