Name of the Vulnerable Software and Affected Versions:

z-push/z-push-dev versions prior to 2.7.6

Description:

The software is vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the `username` field in basic authentication, potentially allowing access to, and modification or deletion of, sensitive data from a linked third-party database. This issue affects Z-Push installations that utilize the IMAP backend and have the `IMAP FROM SQL QUERY` option configured.

Recommendations:

Change configuration to use the default or LDAP in backend/imap/config.php.

Set `IMAP DEFAULTFROM` to an empty string:

```php

define('IMAP DEFAULTFROM','');

```

or

Set `IMAP DEFAULTFROM` to 'ldap':

```php

define('IMAP DEFAULTFROM','ldap');

```