Vulnerabilities in PHProjekt fixed
Version 5.2.1 of the open source groupware PHProjekt fixes a number of security vulnerabilities and numerous other bugs. In addition, password encryption has been improved in order to make life more difficult for rainbow table attacks aimed at cracking passwords.
Using a vulnerability discovered by German security services provider n.runs, it was possible for authenticated users to access the PHProjekt database using SQL injection. In addition, using the calendar and file management module it was possible to upload and execute certain PHP files. On top of this, despite PHProjekt's XSS filters, a number of modules contained exploitable cross-site scripting (XSS) vulnerabilities. Vendor Mayflower recommends switching to the new version as soon as possible.
- PHProjekt 5.2.1: security and bugfix update, bug report from PHProjekt
- Security Advisory PHProjekt 5.2.0, German language overview of the bugs found by n.runs
(ehe)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
