Horde is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in denial-of-service conditions.

Updates are available.

Horde could allow a remote attacker to execute arbitrary code on the system, caused by the improper validation of _formvars form input.

Horde 3.1.x through versions 5.1.1 are vulnerable other versions may also be affected.

Try to execute the phpinfo() command by sending a special crafted HTTP POST request.

• http://www.horde.org
• http://www.securityfocus.com/bid/65200

---

Updated on 2015-03-25