McAfee Email Gateway/McAfee Email和Web Security Appliance多个SQL注入漏洞

CVE ID:CVE-2013-7092

McAfee Email Gateway是一款电子邮件解决方案。McAfee Email and Web Security Appliance用于智能化的垃圾邮件和恶意软件防护。

通过"events_col", "event_id", "reason", "events_order", "emailstatus_order"和"emailstatus_col" JSON键值提交给/admin/cgi-bin/rpc/doReport/18的输入在用于SQL查询之前缺少过滤，允许远程攻击者利用漏洞提交特制的SQL查询，操作或获取数据库数据。
0
McAfee Email and Web Security Appliance 5.x
McAfee Email Gateway 7.x
用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞：
https://kc.mcafee.com/corporate/index?page=content&id=SB10064