Unrated severityNVD Advisory· Published Dec 24, 2009· Updated Jun 16, 2026
CVE-2009-4414
CVE-2009-4414
Description
SQL injection vulnerability in phpgwapi /inc/class.auth_sql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:phpgroupware:phpgroupware:0.9.16.012:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:phpgroupware:phpgroupware:0.9.16.012:*:*:*:*:*:*:*
- (no CPE)range: <0.9.16.014
Patches
Vulnerability mechanics
References
8- secunia.com/advisories/35519nvdVendor Advisory
- svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOGnvd
- svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/inc/class.auth_sql.inc.phpnvd
- svn.savannah.gnu.org/viewvcnvd
- www.openwall.com/lists/oss-security/2009/12/20/1nvd
- www.osvdb.org/56178nvd
- www.securityfocus.com/bid/35761nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/51922nvd
News mentions
0No linked articles in our index yet.