NullLogic Groupware Multiple Vulnerabilities

  1. Network Vulnerabilities
  2. General
  3. NullLogic Groupware Multiple Vulnerabilities
Summary
The host is installed with NullLogic Groupware and is prone to multiple vulnerabilities.
Impact
Attackers can exploit this issue to execute arbitrary SQL quries in the context of affected application, and can cause buffer overflow or denial of service. Impact Level: Application
Solution
No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.
Insight
Multiple flaws occur because, - The 'auth_checkpass' function in the login page does not validate the input passed into the username parameter. - An error in the 'fmessagelist' function in the forum module when processing a group name containing a non-numeric string or is an empty string. - Multiple stack-based buffer overflows occurs in the 'pgsqlQuery' function while processing malicious input to POP3, SMTP or web component that triggers a long SQL query when PostgreSQL is used.
Affected
NullLogic Groupware 1.2.7 and prior on all platforms.
References
Updated on 2015-03-25
Severity
High Severity
Classification
Related Vulnerabilities