CVE:CVE-2008-0807
CNNVD:CNNVD-200802-329
lib/Driver/sql.php的Turba 2 (turba2) Contact Manager H3，以及Horde Groupware和Horde Groupware Webmail Edition等产品中运行时，并不完全验证访问权限，这会允许远程授权用户通过edit.PHP的object_id 参数来修改地址数据，例如当可以对一个共享的地址名册进行写入访问的时候，对一个个人地址名册的登陆进行修改。
solution:Upgrade horde groupware to a higher version than 1.0.3,and avoid the version 1.0.3; Upgrade horde groupware_webmail_edition to a higher version than 1.0.4,and avoid the version 1.0.4; Upgrade horde turba_contact_manager to a higher version than 2.1.6,and avoid the version 2.1.6