CVE-2013-6172

Roundcube webmail < 0.8.7 and 0.9.x < 0.9.5 - SQL Injection via _session Parameter

Title source: llm
STIX 2.1

Description

steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.

References (5)

Core 5
Core References
Patch x_refsource_confirm
http://trac.roundcube.net/ticket/1489382
Patch, Vendor Advisory x_refsource_confirm
http://roundcube.net/news/2013/10/21/security-updates-095-and-087/
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2787

Scores

EPSS 0.0287
EPSS Percentile 85.3%

Details

CWE
CWE-89
Status published
Products (29)
roundcube/webmail 0.1 (11 CPE variants)
roundcube/webmail 0.1.1
roundcube/webmail 0.2 (4 CPE variants)
roundcube/webmail 0.2.1
roundcube/webmail 0.2.2
roundcube/webmail 0.3 (4 CPE variants)
roundcube/webmail 0.3.1
roundcube/webmail 0.4 (2 CPE variants)
roundcube/webmail 0.4.1
roundcube/webmail 0.4.2
... and 19 more
Published Nov 05, 2013
Tracked Since Feb 18, 2026