CVE-2008-6873

Active Web Mail 4.0 - SQL Injection via TabOpenQuickTab1 Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-6873. PoCs published by R3d-D3V!L.

AI-analyzed exploit summary This is a writeup describing a Blind SQL Injection vulnerability in Active Web Mail v4. It provides example URLs and payloads to demonstrate the vulnerability but does not include executable exploit code.

Description

SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the TabOpenQuickTab1 parameter to (1) popaccounts.aspx, (2) addressbook.aspx, and (3) emails.aspx.

Exploits (1)

exploitdb WRITEUP VERIFIED
by R3d-D3V!L · textwebappsasp
https://www.exploit-db.com/exploits/7288

This is a writeup describing a Blind SQL Injection vulnerability in Active Web Mail v4. It provides example URLs and payloads to demonstrate the vulnerability but does not include executable exploit code.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Theoretical
Target: Active Web Mail v4
No auth needed
Prerequisites: Access to the vulnerable web application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/7288
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/52444
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/3303

Scores

EPSS 0.0100
EPSS Percentile 58.2%

Details

CWE
CWE-89
Status published
Products (1)
activewebsoftwares/active_web_mail 4.0
Published Jul 23, 2009
Tracked Since Feb 18, 2026