Remote code execution via attacker-selected IMSP driver

Remote code execution in Horde Groupware Webmail Edition 5.2.22 and earlier allows remote authenticated users to run arbitrary code. Turba_Factory_Driver::create accepts an attacker-supplied array as an address-book configuration, dynamically selects an IMSP driver, and unserializes its attacker-controlled __members value. Exploitation requires an authenticated Horde account and a victim to open a crafted email whose external-image request reaches the vulnerable contacts endpoint; successful execution compromises the webmail server and exposes the victim's clear-text credentials.