Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Turba 2 Contact Manager "lib/Driver/sql.php" 验证绕过漏洞
Vulnerability Description
lib/Driver/sql.php的Turba 2 (turba2) Contact Manager H3，以及Horde Groupware和Horde Groupware Webmail Edition等产品中运行时，并不完全验证访问权限，这会允许远程授权用户通过edit.PHP的object_id 参数来修改地址数据，例如当可以对一个共享的地址名册进行写入访问的时候，对一个个人地址名册的登陆进行修改。
CVSS Information
N/A
Vulnerability Type
N/A