Description
HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpsysinfo | 2.3-7 | — |
| Debian 13 | phpsysinfo | 2.3-7 | — |
| Debian 12 | phpsysinfo | 2.3-7 | — |
| Debian 3.1 | egroupware | 1.0.0.007-2.dfsg-2sarge4 | DSA-899-1 |
| Debian 3.1 | phpgroupware | 0.9.16.005-3.sarge4 | DSA-898-1 |
| Debian 3.1 | phpsysinfo | 2.3-4sarge1 | DSA-897-1 |
| Debian 3.0 | phpgroupware | 0.9.14-0.RC3.2.woody5 | DSA-898-1 |
| Debian 3.0 | phpsysinfo | 2.0-3woody3 | DSA-897-1 |
Advisories 3
- DSA-897-1 phpsysinfo - programming errors Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-899-1 egroupware - programming errors Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-898-1 phpgroupware - programming errors Debian Security (DSA / DLA) · Mar 9, 2026
References
- 17616 third-party-advisory
- MDKSA-2005:212 vendor-advisory
- 15396 vdb-entry
- GLSA-200511-18 vendor-advisory
- 15414 vdb-entry
- 17698 third-party-advisory
- DSA-898 vendor-advisory
- 17441 third-party-advisory
- 20051115 Advisory 22/2005: Multiple vulnerabilities in phpSysInfo mailing-list
- DSA-897 vendor-advisory
- 17620 third-party-advisory
- 17584 third-party-advisory
- http://www.hardened-php.net/advisory_212005.81.html
- 17570 third-party-advisory
- DSA-899 vendor-advisory
- 17643 third-party-advisory
- phpsysinfo-registerglobal-data-manipulation(23107) vdb-entry