Description
The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.
References (3)
Core 3
Core References
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/tw/cp-132-7771-36c50-1.html
Third Party Advisory third-party-advisory
https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290
Third Party Advisory third-party-advisory
https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851
Scores
CVSS v3
7.2
EPSS
0.0209
EPSS Percentile
79.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (1)
hgiga/isherlock
4.5 - 4.5-147
Published
Apr 29, 2024
Tracked Since
Feb 18, 2026