PT-2025-31175 · Unknown+1 · Z-Push-Dev+1

Xbow · Published 2025-07-29 · Updated 2025-08-03 · CVE-2025-8264

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions z-push/z-push-dev versions prior to 2.7.6

Description The software is vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication, potentially allowing access to, and modification or deletion of, sensitive data from a linked third-party database. This issue affects Z-Push installations that utilize the IMAP backend and have the IMAP FROM SQL QUERY option configured.

Recommendations Change configuration to use the default or LDAP in backend/imap/config.php. Set IMAP DEFAULTFROM to an empty string:

define('IMAP DEFAULTFROM','');

or Set IMAP DEFAULTFROM to 'ldap':

define('IMAP DEFAULTFROM','ldap');

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-8264

GHSA-W832-W3P8-CW29

Affected Products

Z-Push

Z-Push-Dev

References · 18

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-8264 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-8264 · Security Note
• https://ubuntu.com/security/CVE-2025-8264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8264 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8264 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w832-w3p8-cw29 · Vendor Advisory
• https://github.com/Z-Hub/Z-Push · Note
• https://github.com/Z-Hub/Z-Push/commit/deb044a40e97dab1814da9aa8330c0a590957fc5 · Note
• https://github.com/Z-Hub/Z-Push/blob/af25a2169a50d6e05a5916d1e8b2b6cd17011c98/src/backend/imap/user_identity.php%23L211C9-L214C25 · Note
• https://github.com/Z-Hub/Z-Push/pull/161/commits/f981d515a35ac4c303959af21dce880a5db02786 · Note
• https://github.com/Z-Hub/Z-Push/pull/161 · Note
• https://twitter.com/cracbot/status/1951961286700372147 · Twitter Post
• https://twitter.com/CveFindCom/status/1950061427433021507 · Twitter Post
• https://twitter.com/CVEnew/status/1950063349233774941 · Twitter Post
• https://xbow.com/blog/xbow-zpush-sqli · Note