Multiple vulnerabilities have been identified in phpGroupWare, which can be exploited by malicious users to conduct SQL injection attacks and execute certain scripts.

An error in the "calendar" module when handling holiday files can be exploited to place server-side scripts in world accessible directories, allowing the scripts to be executed.

Various input validation errors in the "calendar" and "infolog" modules can be exploited to manipulate SQL queries via SQL injection attacks.

Solution
Update to version 0.9.14.007.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers