CVE-2009-1468

Icewarp Email Server < 9.3.0 - SQL Injection

Title source: rule

Description

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query.

Exploits (1)

exploitdb WORKING POC VERIFIED

by RedTeam Pentesting · bashwebappsphp

https://www.exploit-db.com/exploits/32968

View Code ZIP pw:eip

References (6)

[Exploit] http://www.redteam-pentesting.de/advisories/rt-sa-2009-003

[Exploit] http://www.securityfocus.com/bid/34820

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/503226/100/0/threaded

[Third Party Advisory, VDB Entry] http://osvdb.org/54228

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1022169

[Third Party Advisory] http://www.vupen.com/english/advisories/2009/1253

Scores

EPSS 0.0029

EPSS Percentile 52.7%

Details

CWE

CWE-89

Status published

Products (50)

icewarp/email_server 2.10.105

icewarp/email_server 2.10.110

icewarp/email_server 2.10.115

icewarp/email_server 2.10.140

icewarp/email_server 2.10.150

icewarp/email_server 2.10.165

icewarp/email_server 2.10.170

icewarp/email_server 2.10.190

icewarp/email_server 2.10.200

icewarp/email_server 2.10.210

... and 40 more

Published May 05, 2009

Tracked Since Feb 18, 2026