CVE-2015-7984 | BDVDB-2026-72928 Detail

Description#

Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://lists.horde.org/archives/announce/2015/001124.html
http://lists.horde.org/archives/announce/2015/001138.html
https://www.exploit-db.com/exploits/38765/
http://www.debian.org/security/2015/dsa-3391
http://lists.horde.org/archives/announce/2015/001137.html
https://www.htbridge.com/advisory/HTB23272

Exploit#

https://www.exploit-db.com/exploits/38765/

History#

Version 12015-11-19Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.