CVEvulnerability

CVE-2009-1468

6.5 MEDIUM Published 2009-05-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-05-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-89

Description

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query.

Affected configurations

• icewarp email server (<= 9.3.0) • icewarp email server 2.10.105 • icewarp email server 2.10.110 • icewarp email server 2.10.115 • icewarp email server 2.10.140 • icewarp email server 2.10.150 • icewarp email server 2.10.165 • icewarp email server 2.10.170 • icewarp email server 2.10.190 • icewarp email server 2.10.200 • icewarp email server 2.10.210 • icewarp email server 2.10.220 • icewarp email server 2.10.240 • icewarp email server 2.10.250 • icewarp email server 2.10.260 • icewarp email server 2.10.280 • icewarp email server 2.10.290 • icewarp email server 2.10.310 • icewarp email server 2.10.320 • icewarp email server 2.10.330 • icewarp email server 2.10.331 • icewarp email server 2.10.340 • icewarp email server 2.10.350 • icewarp email server 2.10.360 • icewarp email server 3.00.100 • icewarp email server 3.00.110 • icewarp email server 3.00.120 • icewarp email server 3.00.130 • icewarp email server 3.00.140 • icewarp email server 3.10.011 • icewarp email server 3.10.110 • icewarp email server 4.00.30 • icewarp email server 4.2.1 • icewarp email server 4.2.2 • icewarp email server 4.2.3 • icewarp email server 4.4.1 • icewarp email server 4.4.2 • icewarp email server 4.10.040 • icewarp email server 4.10.050 • icewarp email server 5.1.2 • icewarp email server 5.1.3 • icewarp email server 5.1.5 • icewarp email server 5.3.0 • icewarp email server 5.3.2 • icewarp email server 5.4.1 • icewarp email server 5.4.2 • icewarp email server 5.4.3 • icewarp email server 5.4.4 • icewarp email server 5.5.3 • icewarp email server 5.5.4 • icewarp email server 5.5.5 • icewarp email server 5.5.6 • icewarp email server 5.5.7 • icewarp email server 5.7.3 • icewarp email server 5.8.2 • icewarp email server 5.8.3 • icewarp email server 5.8.4 • icewarp email server 5.8.5 • icewarp email server 5.8.6 • icewarp email server 5.9.4 … and 116 more

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References