PT-2004-2626 · Merak · Merak Mail Server

Publicado

2004-08-17

·

Atualizado

2017-07-11

·

CVE-2004-1722

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Merak Mail Server version 5.2.7
Description The issue allows remote attackers to execute arbitrary SQL statements. This is achieved by exploiting a SQL injection vulnerability in the calendar.html file via the schedule parameter in the API endpoint.
Recommendations For Merak Mail Server version 5.2.7, consider restricting access to the calendar.html file until a patch is available. As a temporary workaround, avoid using the schedule parameter in the affected API endpoint to minimize the risk of exploitation.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2004-1722

Produtos afetados

Merak Mail Server