11 lines
No EOL
805 B
Text
11 lines
No EOL
805 B
Text
source: https://www.securityfocus.com/bid/4424/info
|
|
|
|
PHPGroupWare is a freely available, open source groupware system written in PHP. It is distributed and maintained by the PHPGroupWare project.
|
|
|
|
Debian packages of PHPGroupWare ship with an insecure default configuration. The PHP magic_quotes_gpc directive of the PHPGroupWare apache.conf file is disabled by default in Debian packages. This may enable remote attackers to make SQL injection attacks via PHPGroupWare.
|
|
|
|
Under normal circumstances, PHPGroupWare installs with the PHP magic_quotes_gpc directive enabled, to restrict the possibility of SQL injection attacks.
|
|
|
|
Additionally, this issue may also enable an attacker to exploit vulnerabilities that may exist in the underlying database.
|
|
|
|
fubar'; CREATE TABLE thistableshouldnotexist (a int); -- |