CVE-2009-1468

2009-05-0520:30:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2009-1468

sql injection

icewarp email server

webmail server

groupware component

security vulnerability

8 High

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

22.9%

JSON

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query.

CPENameOperatorVersion
icewarp:email_servericewarp email servereq2.10.340
icewarp:webmail_servericewarp webmail servereq4.2.1
icewarp:email_servericewarp email servereq5.9.4
icewarp:webmail_servericewarp webmail servereq6.0.7
icewarp:email_servericewarp email servereq2.10.115
icewarp:webmail_servericewarp webmail servereq7.6.4
icewarp:webmail_servericewarp webmail servereq7.1.4
icewarp:email_servericewarp email servereq4.2.3
icewarp:webmail_servericewarp webmail servereq3.00.140
icewarp:email_servericewarp email servereq7.0.1

CPE	Name	Operator	Version
icewarp:email_server	icewarp email server	eq	2.10.340
icewarp:webmail_server	icewarp webmail server	eq	4.2.1
icewarp:email_server	icewarp email server	eq	5.9.4
icewarp:webmail_server	icewarp webmail server	eq	6.0.7
icewarp:email_server	icewarp email server	eq	2.10.115
icewarp:webmail_server	icewarp webmail server	eq	7.6.4
icewarp:webmail_server	icewarp webmail server	eq	7.1.4
icewarp:email_server	icewarp email server	eq	4.2.3
icewarp:webmail_server	icewarp webmail server	eq	3.00.140
icewarp:email_server	icewarp email server	eq	7.0.1