CVE ID:	CVE-2008-0807
Description:	lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book.
Test IDs:	1.3.6.1.4.1.25623.1.0.60535   1.3.6.1.4.1.25623.1.0.60470   1.3.6.1.4.1.25623.1.0.60440
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2008-0807 BugTraq ID: 27844 http://www.securityfocus.com/bid/27844 Debian Security Information: DSA-1507 (Google Search) http://www.debian.org/security/2008/dsa-1507 https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html http://lists.horde.org/archives/announce/2008/000380.html http://lists.horde.org/archives/announce/2008/000381.html http://lists.horde.org/archives/announce/2008/000378.html http://lists.horde.org/archives/announce/2008/000379.html http://www.securitytracker.com/id?1019433 http://secunia.com/advisories/28982 http://secunia.com/advisories/29071 http://secunia.com/advisories/29184 http://secunia.com/advisories/29185 http://secunia.com/advisories/29186 http://www.vupen.com/english/advisories/2008/0593/references