CVE ID:	CVE-2009-3701
Description:	Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable.
Test IDs:	1.3.6.1.4.1.25623.1.0.67200   1.3.6.1.4.1.25623.1.0.66657
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3701 BugTraq ID: 37351 http://www.securityfocus.com/bid/37351 Bugtraq: 20091217 [ISecAuditors Security Advisories] Horde 3.3.5 "PHP_SELF" Cross-Site Scripting vulnerability (Google Search) http://www.securityfocus.com/archive/1/508531/100/0/threaded http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0388.html http://lists.horde.org/archives/announce/2009/000529.html http://marc.info/?l=horde-announce&m=126100750018478&w=2 http://marc.info/?l=horde-announce&m=126101076422179&w=2 http://securitytracker.com/id?1023365 http://secunia.com/advisories/37709 http://secunia.com/advisories/37823 http://www.vupen.com/english/advisories/2009/3549 http://www.vupen.com/english/advisories/2009/3572 XForce ISS Database: horde-admininterface-xss(54817) https://exchange.xforce.ibmcloud.com/vulnerabilities/54817