PHPGroupWare 0.9.13 Debian Package Configuration Vulnerability

2002-04-03T00:00:00
ID EDB-ID:21365
Type exploitdb
Reporter Matthias Jordan
Modified 2002-04-03T00:00:00

Description

PHPGroupWare 0.9.13 Debian Package Configuration Vulnerability. CVE-2002-0536. Remote exploit for linux platform

                                        
                                            source: http://www.securityfocus.com/bid/4424/info

PHPGroupWare is a freely available, open source groupware system written in PHP. It is distributed and maintained by the PHPGroupWare project.

Debian packages of PHPGroupWare ship with an insecure default configuration. The PHP magic_quotes_gpc directive of the PHPGroupWare apache.conf file is disabled by default in Debian packages. This may enable remote attackers to make SQL injection attacks via PHPGroupWare.

Under normal circumstances, PHPGroupWare installs with the PHP magic_quotes_gpc directive enabled, to restrict the possibility of SQL injection attacks.

Additionally, this issue may also enable an attacker to exploit vulnerabilities that may exist in the underlying database. 

fubar'; CREATE TABLE thistableshouldnotexist (a int); --