CVE-2009-1468
IceWarp eMail Server < 9.3.0 - Authenticated SQL Injection via XML Search Query
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-1468. PoCs published by RedTeam Pentesting.
AI-analyzed exploit summary This exploit demonstrates SQL injection in IceWarp Merak Mail Server by crafting a malicious XML payload sent via a POST request. The script allows an attacker to inject arbitrary SQL queries into the 'order_by' and 'sql' parameters, potentially leading to unauthorized data access or manipulation.
Description
Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query.
Exploits (1)
This exploit demonstrates SQL injection in IceWarp Merak Mail Server by crafting a malicious XML payload sent via a POST request. The script allows an attacker to inject arbitrary SQL queries into the 'order_by' and 'sql' parameters, potentially leading to unauthorized data access or manipulation.