Turba 2 Contact Manager "lib/Driver/sql.php" 验证绕过漏洞

CVE编号

CVE-2008-0807

利用情况

暂无

补丁情况

N/A

披露时间

2008-02-19

漏洞描述

lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058
http://lists.horde.org/archives/announce/2008/000378.html
http://lists.horde.org/archives/announce/2008/000379.html
http://lists.horde.org/archives/announce/2008/000380.html
http://lists.horde.org/archives/announce/2008/000381.html
http://secunia.com/advisories/28982
http://secunia.com/advisories/29071
http://secunia.com/advisories/29184
http://secunia.com/advisories/29185
http://secunia.com/advisories/29186
http://www.debian.org/security/2008/dsa-1507
http://www.securityfocus.com/bid/27844
http://www.securitytracker.com/id?1019433
http://www.vupen.com/english/advisories/2008/0593/references
https://bugzilla.redhat.com/show_bug.cgi?id=432027
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	horde	groupware	1.0.3	-
	运行在以下环境
	应用	horde	groupware_webmail_edition	1.0.4	-
	运行在以下环境
	应用	horde	turba_contact_manager	2.1.6	-
	运行在以下环境
	系统	debian	debian_linux	4.0	-

CVSS3评分 4.9

• 攻击路径 网络
• 攻击复杂度 N/A
• 权限要求 一次
• 影响范围 N/A
• 用户交互 无
• 可用性 无
• 保密性 部分地
• 完整性 部分地

AV:N/AC:M/Au:S/C:P/I:P/A:N

CWE-ID	漏洞类型
CWE-264	权限、特权和访问控制

Exp相关链接

- avd.aliyun.com