PT-2009-3969 · Icewarp · Icewarp Mail Server

Published 2009-05-05 · Updated 2018-10-10 · CVE-2009-1468

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IceWarp eMail Server and WebMail Server versions prior to 9.4.2

Description The issue concerns SQL injection vulnerabilities in the search form of the Groupware component. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands. The vulnerabilities are specifically related to the sql and order by elements in an XML search query.

Recommendations For versions prior to 9.4.2, update to version 9.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the search form in the Groupware component until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-1468

Affected Products

Icewarp Mail Server

References · 8

• 🔥 https://exploit-db.com/exploits/32968 · Exploit
• 🔥 http://securityfocus.com/bid/34820 · Exploit
• 🔥 http://redteam-pentesting.de/advisories/rt-sa-2009-003 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1468 · Security Note
• http://vupen.com/english/advisories/2009/1253 · Note
• http://securitytracker.com/id?1022169 · Note
• http://securityfocus.com/archive/1/503226/100/0/threaded · Note
• http://osvdb.org/54228 · Note