CVE-2020-35743: HGiga MailSherlock - SQL Injection -3

Severity: high (CVSS 7.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-31 · updated 2026-06-17
Weakness: CWE-89

Description

HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages.

Affected products

HGiga Msr45 Isherlock-Antispam: before 4.5-133 — fixed in 4.5-133
HGiga Msr45 Isherlock-User: before 4.5-120 — fixed in 4.5-120
HGiga Ssr45 Isherlock-Antispam: before 4.5-133 — fixed in 4.5-133
HGiga Ssr45 Isherlock-User: before 4.5-120 — fixed in 4.5-120

How to fix

Upgrade to a fixed version: HGiga Msr45 Isherlock-Antispam 4.5-133; HGiga Msr45 Isherlock-User 4.5-120; HGiga Ssr45 Isherlock-Antispam 4.5-133; HGiga Ssr45 Isherlock-User 4.5-120. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-35743 or the next vulnerability affects your stack