Unrated severityNVD Advisory· Published Dec 24, 2009· Updated Apr 23, 2026
CVE-2009-4414
CVE-2009-4414
Description
SQL injection vulnerability in phpgwapi /inc/class.auth_sql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php.
Affected products
1- cpe:2.3:a:phpgroupware:phpgroupware:0.9.16.012:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- secunia.com/advisories/35519nvdVendor Advisory
- svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOGnvd
- svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/inc/class.auth_sql.inc.phpnvd
- svn.savannah.gnu.org/viewvcnvd
- www.openwall.com/lists/oss-security/2009/12/20/1nvd
- www.osvdb.org/56178nvd
- www.securityfocus.com/bid/35761nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/51922nvd
News mentions
0No linked articles in our index yet.