Description
SQL injection vulnerability in the create function in common/include/GroupJoinRequest.class in GForge 4.5 and 4.6 allows remote attackers to execute arbitrary SQL commands via the comments variable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | gforge | 4.5.14-22etch10 | DSA-1698-1 |
Advisories 1
- DSA-1698-1 gforge - SQL injection Debian Security (DSA / DLA) · Mar 9, 2026
References
- 33499 third-party-advisory
- 33229 third-party-advisory
- http://gforge.org/scm/viewvc.php/branches/Branch_4_5/gforge/common/include/GroupJoinRequest.class?root=gforge&r1=4590&r2=6709
- gforge-create-sql-injection(47703) vdb-entry
- 1021510 vdb-entry
- ADV-2009-0004 vdb-entry
- http://gforge.org/scm/viewvc.php/branches/Branch_4_5/gforge/common/include/GroupJoinRequest.class?root=gforge&view=log
- http://security-tracker.debian.net/tracker/CVE-2008-2381
- 33086 vdb-entry