SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php in EGroupware Enterprise Line (EPL) before 11.1.201108

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• egroupware egroupwareup to 1.8.001.20110421 inclusive
• egroupware egroupware enterprise lineup to 11.1.20110711-1 inclusive

Other highest-scoring records for the same primary product.

• CVE-2007-3155Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack vectors related to ADOdb.
  41Plan
• CVE-2007-3154Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packa
  41Plan
• CVE-2008-2041Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has
  40Plan
• CVE-2024-40614EGroupware before 23.1.20240624 mishandles an ORDER BY clause.
  39Monitor
• CVE-2014-2988EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta
  35Monitor
• CVE-2026-40187Authenticated RCE via Malicious eTemplate Upload in EGroupware
  34Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.