PT-2025-31175 · Z-Push+1 · Z-Push+1

Xbow

·

CVE-2025-8264

·

Published

2025-07-29

·

Updated

2025-08-03

CVSS v3.1

9.0

Critical

VectorAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions z-push/z-push-dev versions prior to 2.7.6
Description The software is vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication, potentially allowing access to, and modification or deletion of, sensitive data from a linked third-party database. This issue affects Z-Push installations that utilize the IMAP backend and have the IMAP FROM SQL QUERY option configured.
Recommendations Change configuration to use the default or LDAP in backend/imap/config.php. Set IMAP DEFAULTFROM to an empty string:
php
define('IMAP DEFAULTFROM','');
or Set IMAP DEFAULTFROM to 'ldap':
php
define('IMAP DEFAULTFROM','ldap');

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-8264
GHSA-W832-W3P8-CW29

Affected Products

Z-Push
Z-Push-Dev