CVE-2003-0025 Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as c...
HighCVSS 7.5
EPSS 28.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in db.pgsql, as demonstrated using mailbox.php3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde imp | = 2.2 | No fix listed |
| horde imp | = 2.2.1 | No fix listed |
| horde imp | = 2.2.2 | No fix listed |
| horde imp | = 2.2.3 | No fix listed |
| horde imp | = 2.2.4 | No fix listed |
| horde imp | = 2.2.5 | No fix listed |
| horde imp | = 2.2.6 | No fix listed |
| horde imp | = 2.2.7 | No fix listed |
| horde imp | = 2.2.8 | No fix listed |
References
- 20030108 IMP 2.x SQL injection vulnerabilities mailing-list
- 8087 third-party-advisory
- 8177 third-party-advisory
- DSA-229 patch vendor-advisory
- 20030108 Re: IMP 2.x SQL injection vulnerabilities mailing-list
- 6559 vdb-entry
- 1005904 vdb-entry