CVE-2014-2988

CVE-2014-2988 describes a remote code execution vulnerability affecting EGroupware Enterprise Line, Community Edition, and earlier versions of EGroupware. Authenticated administrators can execute arbitrary PHP code by manipulating callback values in the newsettings[system] parameter, leveraging the call_user_func PHP function. This vulnerability carries a high CVSS score of 8.5, indicating a network-based attack with medium complexity, leading to complete compromise of confidentiality, integrity, and availability. While it can be exploited by remote attackers, potentially in conjunction with CVE-2014-2987, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.