Published: 23/03/2020 Updated: 07/10/2022

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 6.3 | Impact Score: 3.4 | Exploitability Score: 2.8

VMScore: 660

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

This vulnerability allows remote malicious users to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the params[template] parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10469.

Vulnerable Product	Search on Vulmon	Subscribe to Product
horde groupware 5.2.22
debian debian linux 8.0

Debian Bug report logs - #955019 php-horde-trean: CVE-2020-8865 Package: src:php-horde-trean; Maintainer for src:php-horde-trean is Horde Maintainers <team+debian-horde-team@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 26 Mar 2020 20:57:01 UTC Severity: important Tags: securit ...

## exploit-phar-loadingpy #!/usr/bin/env python3 from horde import Horde import requests import subprocess import sys TEMP_DIR = '/tmp' WWW_ROOT = '/var/www/html' if len(sysargv) < 5: print('Usage: <base_url> <username> <password> <filename> <php_code>') sysexit(1) base_url = sysargv[1] username = sys ...

## exploit-inc-inclusionpy #!/usr/bin/env python3 from horde import Horde import subprocess import sys TEMP_DIR = '/tmp' if len(sysargv) < 5: print('Usage: <base_url> <username> <password> <filename> <php_code>') sysexit(1) base_url = sysargv[1] username = sysargv[2] password = sysargv[3] filename = ...

CWE-22 https://www.zerodayinitiative.com/advisories/ZDI-20-276/https://lists.debian.org/debian-lts-announce/2020/04/msg00009.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=955019 https://nvd.nist.gov https://www.exploit-db.com/exploits/48210

CVE-2020-8865

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect