Multiple SQL injection vulnerabilities in index.php in eGroupware before 1.0.0.007 allow remote attackers to execute arbitrary SQL commands via the (1) filter or (2) cats_app parameter.

Multiple cross-site scripting (XSS) vulnerabilities in eGroupware before 1.0.0.007 allow remote attackers to inject arbitrary web script or HTML via the (1) ab_id, (2) page, (3) type, or (4) lang parameter to index.php or (5) category_id parameter.

Multiple SQL injection vulnerabilities in index.php in eGroupware before 1.0.0.007 allow remote attackers to execute arbitrary SQL commands via the (1) filter or (2) cats_app parameter.

The remote host is affected by the vulnerability described in GLSA-200504-24 (eGroupWare: XSS and SQL injection vulnerabilities)

    Multiple SQL injection and cross-site scripting vulnerabilities have     been found in several eGroupWare modules.
  Impact :

    An attacker could possibly use the SQL injection vulnerabilities to gain     information from the database. Furthermore the cross-site scripting     issues give an attacker the ability to inject and execute malicious     script code or to steal cookie based authentication credentials,     potentially compromising the victim's browser.
  Workaround :

    There is no known workaround at this time.

The remote host is running eGroupWare, a web-based groupware solution. It is reported that versions prior 1.0.0.007 are prone to an information disclosure vulnerability.  Specifically, if a user composes an email with an attachment and then cancels the email, the attachment will be attached and sent with the next outbound email.

The remote host is running eGroupWare, a web-based groupware solution. 

It is reported that versions 1.0.0.006 and older are prone to multiple SQL injection and cross-site scripting flaws.

The remote host is running eGroupWare, a web-based groupware solution. It is reported that versions prior 1.0.0.006 are prone to an unspecified vulnerability.

ID	Name	Product	Family	Severity
19355	FreeBSD : egroupware -- multiple XSS (XSS) and SQL injection vulnerabilities (b4892b5b-fb1c-11d9-96ba-00909925db3e)	Nessus	FreeBSD Local Security Checks	high
18127	GLSA-200504-24 : eGroupWare: XSS and SQL injection vulnerabilities	Nessus	Gentoo Local Security Checks	high
2819	EGroupWare < 1.0.0.007 Attachment Information Disclosure	Nessus Network Monitor	CGI	high
15719	EGroupWare Multiple Vulnerabilities (SQLi, ID)	Nessus	CGI abuses	high
2398	eGroupWare < 1.0.0.006 JiNN Application Unspecified Vulnerability	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2005-1203

critical

Tenable Plugins

high

high

high

high

medium