CVE-2014-2988 | BDVDB-2026-65866 Detail

Description#

EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://advisories.mageia.org/MGASA-2014-0221.html
http://www.mandriva.com/security/advisories?name=MDVSA-2015:087
https://www.htbridge.com/advisory/HTB23212
http://www.securityfocus.com/archive/1/532103/100/0/threaded

Exploit#

No public exploit known

History#

Version 12014-10-27Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.