CVE-2017-6089

Critical

Published: 03/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An SQL injection vulnerability in PhpCollab versions 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or id parameters to topics/deletetopics.php; the (2) id parameter to bookmarks/deletebookmarks.php; or the (3) id parameter to calendar/deletecalendar.php.

Risk Assessment

This vulnerability may lead to unauthorized access to the database and exposure of sensitive information. It could also allow attackers to modify data within the system.

Recommendation

It is recommended to update PhpCollab to the latest version that addresses this vulnerability. Additionally, implementing input validation and sanitization measures is advisable.

Original NVD description (English source)

SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or id parameters to topics/deletetopics.php; the (2) id parameter to bookmarks/deletebookmarks.php; or the (3) id parameter to calendar/deletecalendar.php.