← Database

CVE-2024-40614

CRITICAL CVSS: 9.8 Published: 2024-07-07 Modified: 2026-06-17

Description

EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.

Affected Platforms

Egroupware Egroupware

Weakness Type

NVD-CWE-noinfo, CWE-89

References