Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable.
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
| Link | Tags |
|---|---|
| http://secunia.com/advisories/37823 | third party advisory vendor advisory |
| http://marc.info/?l=horde-announce&m=126100750018478&w=2 | mailing list |
| http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0388.html | mailing list exploit |
| http://lists.horde.org/archives/announce/2009/000529.html | mailing list patch |
| http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.559&r2=1.515.2.589&ty=h | |
| http://www.vupen.com/english/advisories/2009/3549 | vdb entry patch vendor advisory |
| http://www.securityfocus.com/archive/1/508531/100/0/threaded | mailing list |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/54817 | vdb entry |
| http://www.securityfocus.com/bid/37351 | vdb entry exploit |
| http://marc.info/?l=horde-announce&m=126101076422179&w=2 | mailing list patch |
| http://secunia.com/advisories/37709 | third party advisory vendor advisory |
| http://www.vupen.com/english/advisories/2009/3572 | vdb entry patch vendor advisory |
| http://securitytracker.com/id?1023365 | vdb entry |