EGroupware mishandles an ORDER BY clause

CRITICAL 9.8CVE-2024-40614 · GHSA-phg7-8mm9-gj88 · Published 07/07/2024 · updated 17/06/2026

In short

CVE-2024-40614 is a CRITICAL (CVSS 9.8) vulnerability affecting egroupware/egroupware, egroupware (egroupware).
Chance of exploitation in the next 30 days (EPSS): 0.68%, higher than 52.3% of all vulnerabilities.
Fix: update to 23.1.20240624 or later.

Package	Affected versions	Patched versions
egroupware/egroupware Packagist	`< 23.1.20240624`	`23.1.20240624`
egroupware egroupware	`< 23.1.20240624`	`23.1.20240624`

Description

EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.

NVD description

EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.

References

nvd.nist.gov/vuln/detail/CVE-2024-40614 · ADVISORY
EGroupware/egroupware commit 553829d · WEB
EGroupware/egroupware · PACKAGE
EGroupware/egroupware · WEB
EGroupware/egroupware release 23.1.20240624 · WEB
help.egroupware.org/t/egroupware-maintenance-security-release-23-1-20240624/78438 · WEB
syss.de · WEB
syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-047.txt · WEB
syss.de/pentest-blog/sql-injection-schwachstelle-in-egroupware-syss-2024-047 · WEB

More vulnerabilities in egroupware/egroupware

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

egroupware/egroupware

Packagist

< 23.1.20240624

23.1.20240624

egroupware

< 23.1.20240624

23.1.20240624

Description

NVD description

More vulnerabilities in egroupware/egroupware

See all →