CVE-2013-7092

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-12-13 · updated 2026-06-17
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in /admin/cgi-bin/rpc/doReport/18 in McAfee Email Gateway 7.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) events_col, (2) event_id, (3) reason, (4) events_order, (5) emailstatus_order, or (6) emailstatus_col JSON keys.

Affected products

Intel McAfee Email Gateway (MEG): 7.6

References

http://osvdb.org/100582
http://packetstormsecurity.com/files/124277/McAfee-Email-Gateway-7.6-Command-Execution-SQL-Injection.html
http://seclists.org/fulldisclosure/2013/Dec/18
http://www.securityfocus.com/bid/64150
https://exchange.xforce.ibmcloud.com/vulnerabilities/90161
http://osvdb.org/100582
http://packetstormsecurity.com/files/124277/McAfee-Email-Gateway-7.6-Command-Execution-SQL-Injection.html
http://seclists.org/fulldisclosure/2013/Dec/18
http://www.securityfocus.com/bid/64150
https://exchange.xforce.ibmcloud.com/vulnerabilities/90161

Get alerted when CVE-2013-7092 or the next vulnerability affects your stack