CVE-2009-1468

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-05-05 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query.

Affected products

IceWarp Email Server: through 9.3.0; 2.10.105, 2.10.110, 2.10.115, 2.10.140, 2.10.150, 2.10.165 (+81)
IceWarp Webmail Server: through 9.3.0; 2.10.105, 2.10.110, 2.10.115, 2.10.140, 2.10.150, 2.10.165 (+81)

References

http://osvdb.org/54228
http://www.redteam-pentesting.de/advisories/rt-sa-2009-003
http://www.securityfocus.com/archive/1/503226/100/0/threaded
http://www.securityfocus.com/bid/34820
http://www.securitytracker.com/id?1022169
http://www.vupen.com/english/advisories/2009/1253
http://osvdb.org/54228
http://www.redteam-pentesting.de/advisories/rt-sa-2009-003
http://www.securityfocus.com/archive/1/503226/100/0/threaded
http://www.securityfocus.com/bid/34820
http://www.securitytracker.com/id?1022169
http://www.vupen.com/english/advisories/2009/1253

Get alerted when CVE-2009-1468 or the next vulnerability affects your stack