CVE-2012-4240: SQL Injection
Published Sep 11, 2014
·Updated
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
Affected Software
1 affected component
Group-Office Groupoffice<=4.0.89
Event History
Sep 11, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-4240?
CVE-2012-4240 has a medium severity rating due to its potential for SQL injection exploits.
2
How do I fix CVE-2012-4240?
To fix CVE-2012-4240, upgrade Group-Office to version 4.0.90 or later.
3
Who is affected by CVE-2012-4240?
CVE-2012-4240 affects remote authenticated users of Group-Office community versions prior to 4.0.90.
4
What kind of attack can CVE-2012-4240 enable?
CVE-2012-4240 can enable attackers to execute arbitrary SQL commands on the affected system.
5
In which file does CVE-2012-4240 exist?
CVE-2012-4240 exists in the modules/calendar/json.php file of Group-Office.