SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL statements via the schedule parameter.

The target is running at least one instance of Merak Webmail / IceWarp Web Mail 5.2.7 or less or Merak Mail Server 7.5.2 or less.  Such versions are potentially affected by multiple cross-site scripting, HTML and SQL injection, and PHP source code disclosure vulnerabilities.

The remote host is running Merak Mail Server. It is reported that versions prior to 7.5.1 are prone to multiple vulnerabilities in the Web Mail module. An attacker may use these vulnerabilities to perform cross-site scripting attacks, SQL injection and access to the PHP source code.

ID	Name	Product	Family	Severity
14379	Merak Webmail / IceWarp Web Mail < 5.2.8 Multiple Vulnerabilities	Nessus	CGI abuses	high
2158	Merak Mail Server < 7.5.2 Web Mail Module Multiple Vulnerabilities	Nessus Network Monitor	IMAP Servers	high
2157	Merak Mail Server < 7.5.2 Web Mail Module Multiple Vulnerabilities	Nessus Network Monitor	SMTP Servers	high
2156	Merak Mail Server < 7.5.1 Web Mail Module Multiple Vulnerabilities	Nessus Network Monitor	POP Server	high

Detections

Analytics

CVE-2004-1722

critical

Tenable Plugins

high

high

high

high