CVE-2024-40614 EGroupware mishandles an ORDER BY clause
Authenticated users can exploit SQL injection in EGroupware's sorting functionality to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40614?
CVE-2024-40614 is a medium-severity SQL injection vulnerability in n/a, published on 7 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.
Weakness: CWE-89
Which versions are affected by CVE-2024-40614?
2 open source packages ship an affected version, including egroupware/egroupware. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
egroupware/egroupware Packagist | All versions | 23.1.20240624 |
egroupware/egroupware Packagist | All versions | 23.1.20240624 |
Products include Egroupware Egroupware.
How do I fix CVE-2024-40614?
Upgrade egroupware/egroupware to 23.1.20240624 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-40614 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-40614 exists.
Other vulnerabilities in n/a
- CVE-2008-2041 Code injection in n/a
- CVE-2007-3154 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packa
- CVE-2007-3155 Other in n/a
- CVE-2026-22243 EGroupware has SQL Injection in Nextmatch Filter Processing
- CVE-2014-2988 Code injection in n/a
Sources
Also known as GHSA-phg7-8mm9-gj88.