Description
Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) sensor_program parameter or the (2) _SERVER[HTTP_ACCEPT_LANGUAGE] parameter, which overwrites an internal variable, a variant of CVE-2003-0536. NOTE: due to a typo in an advisory, an issue in osh was inadvertently linked to this identifier; the proper identifier for the osh issue is CVE-2005-3346.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpsysinfo | 2.3-7 | — |
| Debian 13 | phpsysinfo | 2.3-7 | — |
| Debian 12 | phpsysinfo | 2.3-7 | — |
| Debian 3.1 | egroupware | 1.0.0.007-2.dfsg-2sarge4 | DSA-899-1 |
| Debian 3.1 | phpgroupware | 0.9.16.005-3.sarge4 | DSA-898-1 |
| Debian 3.1 | phpsysinfo | 2.3-4sarge1 | DSA-897-1 |
| Debian 3.0 | phpgroupware | 0.9.14-0.RC3.2.woody5 | DSA-898-1 |
| Debian 3.0 | phpsysinfo | 2.0-3woody3 | DSA-897-1 |
Advisories 3
- DSA-897-1 phpsysinfo - programming errors Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-899-1 egroupware - programming errors Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-898-1 phpgroupware - programming errors Debian Security (DSA / DLA) · Mar 9, 2026
References
- 17616 third-party-advisory
- MDKSA-2005:212 vendor-advisory
- 15396 vdb-entry
- GLSA-200511-18 vendor-advisory
- 15414 vdb-entry
- 17698 third-party-advisory
- DSA-898 vendor-advisory
- 17441 third-party-advisory
- 20051115 Advisory 22/2005: Multiple vulnerabilities in phpSysInfo mailing-list
- DSA-897 vendor-advisory
- 17620 third-party-advisory
- 17584 third-party-advisory
- http://www.hardened-php.net/advisory_212005.81.html
- 17570 third-party-advisory
- DSA-899 vendor-advisory
- 17643 third-party-advisory
- phpsysinfo-registerglobal-data-manipulation(23107) vdb-entry