EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| egroupware/egroupware(Packagist) | 0 | 23.1.20240624 | N/A |
CVSS Metrics
