CVE-2012-4240

Name of the Vulnerable Software and Affected Versions Group-Office community versions prior to 4.0.90

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the sort parameter in the modules/calendar/json.php file.

Recommendations For versions prior to 4.0.90, update to version 4.0.90 or later to resolve the issue. As a temporary workaround, consider restricting access to the modules/calendar/json.php file or avoiding the use of the sort parameter until the update is applied.