Exploit phpGroupWare 0.9.13 - Debian Package Configuration

[Exploiter]

EDB-ID

21365

Проверка EDB

1. Пройдено

Автор

MATTHIAS JORDAN

Тип уязвимости

REMOTE

Платформа

LINUX

CVE

cve-2002-0536

Дата публикации

2002-04-03

source: https://www.securityfocus.com/bid/4424/info

PHPGroupWare is a freely available, open source groupware system written in PHP. It is distributed and maintained by the PHPGroupWare project.

Debian packages of PHPGroupWare ship with an insecure default configuration. The PHP magic_quotes_gpc directive of the PHPGroupWare apache.conf file is disabled by default in Debian packages. This may enable remote attackers to make SQL injection attacks via PHPGroupWare.

Under normal circumstances, PHPGroupWare installs with the PHP magic_quotes_gpc directive enabled, to restrict the possibility of SQL injection attacks.

Additionally, this issue may also enable an attacker to exploit vulnerabilities that may exist in the underlying database. 

fubar'; CREATE TABLE thistableshouldnotexist (a int); --