by Kastro
Paper/Archive/CVE-2024-40614

CVE-2024-40614

mitre — EGroupware before 23.1.20240624 mishandles an ORDER BY clause.

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.3.523 × 2010.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refsyss.derefgithub.com/EGroupware/egroupware/releases/tag/23.1.20240624refhelp.egroupware.org/t/egroupware-maintenance-security-release-23-1-20240624/78438refgithub.com/EGroupware/egroupware/compare/23.1.20240430...23.1.20240624refgithub.com/EGroupware/egroupware/commit/553829d30cc2ccdc0e5a8c5a0e16fa03a3399a3frefsyss.de/pentest-blog/sql-injection-schwachstelle-in-egroupware-syss-2024-047refsyss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-047.txt