GHSA-5gx6-f2qq-475f
EGroupware Code Injection vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | egroupware/egroupware | < 1.6.003 | 1.6.003 |
| Packagist | egroupware/egroupware | >= 9.1, < 9.1.20100309 | 9.1.20100309 |
| Packagist | egroupware/egroupware | >= 9.2, < 9.2.20100309 | 9.2.20100309 |
Details
As written in the advisory (Markdown source, shown as plain text).
`phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php` in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) aspell_path or (2) spellchecker_lang parameters.
References
External links from the advisory. They lead to third-party sites.