Description
Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the (1) order, (2) project_id, (3) pro_main, or (4) hours_id parameters to index.php or (5) ticket_id to viewticket_details.php.
Product(s):
- PhpGroupWare 0.9.12
- PhpGroupWare 0.9.13
- PhpGroupWare 0.9.14.003
- PhpGroupWare 0.9.14.005
- PhpGroupWare 0.9.14.006
- PhpGroupWare 0.9.14.007
- PhpGroupWare 0.9.14
- PhpGroupWare 0.9.16.000
- PhpGroupWare 0.9.16.002
- PhpGroupWare 0.9.16.003
- PhpGroupWare 0.9.16 RC1
Question to Ask Vendors:
- Can you confirm whether your systems are affected by CVE-2004-1383, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2004-1383 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions:
- Check out the advisory links provided below.