IceWarp Merak Mail Server Groupware Component Multiple SQL Injection Vulnerabilities

Bugtraq ID:	34820
Class:	Input Validation Error
CVE:	CVE-2009-1468
Remote:	Yes
Local:	No
Published:	May 05 2009 12:00AM
Updated:	May 06 2009 04:26PM
Credit:	RedTeam Pentesting GmbH
Vulnerable:	IceWarp Merak Mail Server 9.4.1
Not Vulnerable:	IceWarp Merak Mail Server 9.4.2

IceWarp Merak Mail Server Groupware Component Multiple SQL Injection Vulnerabilities

IceWarp Merak Mail Server is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

IceWarp Merak Mail Server 9.4.1 is affected; other versions may be vulnerable as well.

IceWarp Merak Mail Server Groupware Component Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

The following exploit is available:

• /data/vulnerabilities/exploits/34820.sh

IceWarp Merak Mail Server Groupware Component Multiple SQL Injection Vulnerabilities

Solution:
Updates are available. Please contact the vendor for details.

IceWarp Merak Mail Server Groupware Component Multiple SQL Injection Vulnerabilities

References:

• Advisory: IceWarp WebMail Server: SQL Injection in Groupware Component (RedTeam Pentesting GmbH)
  
• Merak Mail Server Homepage (IceWarp)
  
• [RT-SA-2009-003] IceWarp WebMail Server: SQL Injection in Groupware Component (RedTeam Pentesting GmbH )