Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query.
2009-05-05T20:30:00.233
2025-04-09T00:30:58.490
Deferred
CVSSv2: 6.5 (MEDIUM)
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.0
6.4
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | icewarp | email_server | ≤ 9.3.0 | Yes |
| Application | icewarp | email_server | 2.10.105 | Yes |
| Application | icewarp | email_server | 2.10.110 | Yes |
| Application | icewarp | email_server | 2.10.115 | Yes |
| Application | icewarp | email_server | 2.10.140 | Yes |
| Application | icewarp | email_server | 2.10.150 | Yes |
| Application | icewarp | email_server | 2.10.165 | Yes |
| Application | icewarp | email_server | 2.10.170 | Yes |
| Application | icewarp | email_server | 2.10.190 | Yes |
| Application | icewarp | email_server | 2.10.200 | Yes |
| Application | icewarp | email_server | 2.10.210 | Yes |
| Application | icewarp | email_server | 2.10.220 | Yes |
| Application | icewarp | email_server | 2.10.240 | Yes |
| Application | icewarp | email_server | 2.10.250 | Yes |
| Application | icewarp | email_server | 2.10.260 | Yes |
| Application | icewarp | email_server | 2.10.280 | Yes |
| Application | icewarp | email_server | 2.10.290 | Yes |
| Application | icewarp | email_server | 2.10.310 | Yes |
| Application | icewarp | email_server | 2.10.320 | Yes |
| Application | icewarp | email_server | 2.10.330 | Yes |
| Application | icewarp | email_server | 2.10.331 | Yes |
| Application | icewarp | email_server | 2.10.340 | Yes |
| Application | icewarp | email_server | 2.10.350 | Yes |
| Application | icewarp | email_server | 2.10.360 | Yes |
| Application | icewarp | email_server | 3.00.100 | Yes |
| Application | icewarp | email_server | 3.00.110 | Yes |
| Application | icewarp | email_server | 3.00.120 | Yes |
| Application | icewarp | email_server | 3.00.130 | Yes |
| Application | icewarp | email_server | 3.00.140 | Yes |
| Application | icewarp | email_server | 3.10.011 | Yes |
| Application | icewarp | email_server | 3.10.110 | Yes |
| Application | icewarp | email_server | 4.00.30 | Yes |
| Application | icewarp | email_server | 4.2.1 | Yes |
| Application | icewarp | email_server | 4.2.2 | Yes |
| Application | icewarp | email_server | 4.2.3 | Yes |
| Application | icewarp | email_server | 4.4.1 | Yes |
| Application | icewarp | email_server | 4.4.2 | Yes |
| Application | icewarp | email_server | 4.10.040 | Yes |
| Application | icewarp | email_server | 4.10.050 | Yes |
| Application | icewarp | email_server | 5.1.2 | Yes |
| Application | icewarp | email_server | 5.1.3 | Yes |
| Application | icewarp | email_server | 5.1.5 | Yes |
| Application | icewarp | email_server | 5.3.0 | Yes |
| Application | icewarp | email_server | 5.3.2 | Yes |
| Application | icewarp | email_server | 5.4.1 | Yes |
| Application | icewarp | email_server | 5.4.2 | Yes |
| Application | icewarp | email_server | 5.4.3 | Yes |
| Application | icewarp | email_server | 5.4.4 | Yes |
| Application | icewarp | email_server | 5.5.3 | Yes |
| Application | icewarp | email_server | 5.5.4 | Yes |
| Application | icewarp | email_server | 5.5.5 | Yes |
| Application | icewarp | email_server | 5.5.6 | Yes |
| Application | icewarp | email_server | 5.5.7 | Yes |
| Application | icewarp | email_server | 5.7.3 | Yes |
| Application | icewarp | email_server | 5.8.2 | Yes |
| Application | icewarp | email_server | 5.8.3 | Yes |
| Application | icewarp | email_server | 5.8.4 | Yes |
| Application | icewarp | email_server | 5.8.5 | Yes |
| Application | icewarp | email_server | 5.8.6 | Yes |
| Application | icewarp | email_server | 5.9.4 | Yes |
| Application | icewarp | email_server | 6.0.2 | Yes |
| Application | icewarp | email_server | 6.0.3 | Yes |
| Application | icewarp | email_server | 6.0.5 | Yes |
| Application | icewarp | email_server | 6.0.7 | Yes |
| Application | icewarp | email_server | 6.1.0 | Yes |
| Application | icewarp | email_server | 6.2.1 | Yes |
| Application | icewarp | email_server | 7.0.1 | Yes |
| Application | icewarp | email_server | 7.1.4 | Yes |
| Application | icewarp | email_server | 7.1.6 | Yes |
| Application | icewarp | email_server | 7.2.0 | Yes |
| Application | icewarp | email_server | 7.4.0 | Yes |
| Application | icewarp | email_server | 7.4.2 | Yes |
| Application | icewarp | email_server | 7.4.5 | Yes |
| Application | icewarp | email_server | 7.5.2 | Yes |
| Application | icewarp | email_server | 7.6.0 | Yes |
| Application | icewarp | email_server | 7.6.4 | Yes |
| Application | icewarp | email_server | 8.0.1 | Yes |
| Application | icewarp | email_server | 8.0.2 | Yes |
| Application | icewarp | email_server | 8.0.3 | Yes |
| Application | icewarp | email_server | 8.2.0 | Yes |
| Application | icewarp | email_server | 8.2.2 | Yes |
| Application | icewarp | email_server | 8.3.5 | Yes |
| Application | icewarp | email_server | 8.3.8 | Yes |
| Application | icewarp | email_server | 8.5.0 | Yes |
| Application | icewarp | email_server | 8.9.1 | Yes |
| Application | icewarp | email_server | 9.0.0 | Yes |
| Application | icewarp | email_server | 9.1.0 | Yes |
| Application | icewarp | email_server | 9.2.0 | Yes |
| Application | icewarp | webmail_server | ≤ 9.3.0 | Yes |
| Application | icewarp | webmail_server | 2.10.105 | Yes |
| Application | icewarp | webmail_server | 2.10.110 | Yes |
| Application | icewarp | webmail_server | 2.10.115 | Yes |
| Application | icewarp | webmail_server | 2.10.140 | Yes |
| Application | icewarp | webmail_server | 2.10.150 | Yes |
| Application | icewarp | webmail_server | 2.10.165 | Yes |
| Application | icewarp | webmail_server | 2.10.170 | Yes |
| Application | icewarp | webmail_server | 2.10.190 | Yes |
| Application | icewarp | webmail_server | 2.10.200 | Yes |
| Application | icewarp | webmail_server | 2.10.210 | Yes |
| Application | icewarp | webmail_server | 2.10.220 | Yes |
| Application | icewarp | webmail_server | 2.10.240 | Yes |
| Application | icewarp | webmail_server | 2.10.250 | Yes |
| Application | icewarp | webmail_server | 2.10.260 | Yes |
| Application | icewarp | webmail_server | 2.10.280 | Yes |
| Application | icewarp | webmail_server | 2.10.290 | Yes |
| Application | icewarp | webmail_server | 2.10.310 | Yes |
| Application | icewarp | webmail_server | 2.10.320 | Yes |
| Application | icewarp | webmail_server | 2.10.330 | Yes |
| Application | icewarp | webmail_server | 2.10.331 | Yes |
| Application | icewarp | webmail_server | 2.10.340 | Yes |
| Application | icewarp | webmail_server | 2.10.350 | Yes |
| Application | icewarp | webmail_server | 2.10.360 | Yes |
| Application | icewarp | webmail_server | 3.00.100 | Yes |
| Application | icewarp | webmail_server | 3.00.110 | Yes |
| Application | icewarp | webmail_server | 3.00.120 | Yes |
| Application | icewarp | webmail_server | 3.00.130 | Yes |
| Application | icewarp | webmail_server | 3.00.140 | Yes |
| Application | icewarp | webmail_server | 3.10.011 | Yes |
| Application | icewarp | webmail_server | 3.10.110 | Yes |
| Application | icewarp | webmail_server | 4.00.30 | Yes |
| Application | icewarp | webmail_server | 4.2.1 | Yes |
| Application | icewarp | webmail_server | 4.2.2 | Yes |
| Application | icewarp | webmail_server | 4.2.3 | Yes |
| Application | icewarp | webmail_server | 4.4.1 | Yes |
| Application | icewarp | webmail_server | 4.4.2 | Yes |
| Application | icewarp | webmail_server | 4.10.040 | Yes |
| Application | icewarp | webmail_server | 4.10.050 | Yes |
| Application | icewarp | webmail_server | 5.1.2 | Yes |
| Application | icewarp | webmail_server | 5.1.3 | Yes |
| Application | icewarp | webmail_server | 5.1.5 | Yes |
| Application | icewarp | webmail_server | 5.3.0 | Yes |
| Application | icewarp | webmail_server | 5.3.2 | Yes |
| Application | icewarp | webmail_server | 5.4.1 | Yes |
| Application | icewarp | webmail_server | 5.4.2 | Yes |
| Application | icewarp | webmail_server | 5.4.3 | Yes |
| Application | icewarp | webmail_server | 5.4.4 | Yes |
| Application | icewarp | webmail_server | 5.5.3 | Yes |
| Application | icewarp | webmail_server | 5.5.4 | Yes |
| Application | icewarp | webmail_server | 5.5.5 | Yes |
| Application | icewarp | webmail_server | 5.5.6 | Yes |
| Application | icewarp | webmail_server | 5.5.7 | Yes |
| Application | icewarp | webmail_server | 5.7.3 | Yes |
| Application | icewarp | webmail_server | 5.8.2 | Yes |
| Application | icewarp | webmail_server | 5.8.3 | Yes |
| Application | icewarp | webmail_server | 5.8.4 | Yes |
| Application | icewarp | webmail_server | 5.8.5 | Yes |
| Application | icewarp | webmail_server | 5.8.6 | Yes |
| Application | icewarp | webmail_server | 5.9.4 | Yes |
| Application | icewarp | webmail_server | 6.0.2 | Yes |
| Application | icewarp | webmail_server | 6.0.3 | Yes |
| Application | icewarp | webmail_server | 6.0.5 | Yes |
| Application | icewarp | webmail_server | 6.0.7 | Yes |
| Application | icewarp | webmail_server | 6.1.0 | Yes |
| Application | icewarp | webmail_server | 6.2.1 | Yes |
| Application | icewarp | webmail_server | 7.0.1 | Yes |
| Application | icewarp | webmail_server | 7.1.4 | Yes |
| Application | icewarp | webmail_server | 7.1.6 | Yes |
| Application | icewarp | webmail_server | 7.2.0 | Yes |
| Application | icewarp | webmail_server | 7.4.0 | Yes |
| Application | icewarp | webmail_server | 7.4.2 | Yes |
| Application | icewarp | webmail_server | 7.4.5 | Yes |
| Application | icewarp | webmail_server | 7.5.2 | Yes |
| Application | icewarp | webmail_server | 7.6.0 | Yes |
| Application | icewarp | webmail_server | 7.6.4 | Yes |
| Application | icewarp | webmail_server | 8.0.1 | Yes |
| Application | icewarp | webmail_server | 8.0.2 | Yes |
| Application | icewarp | webmail_server | 8.0.3 | Yes |
| Application | icewarp | webmail_server | 8.2.0 | Yes |
| Application | icewarp | webmail_server | 8.2.2 | Yes |
| Application | icewarp | webmail_server | 8.3.5 | Yes |
| Application | icewarp | webmail_server | 8.3.8 | Yes |
| Application | icewarp | webmail_server | 8.5.0 | Yes |
| Application | icewarp | webmail_server | 8.9.1 | Yes |
| Application | icewarp | webmail_server | 9.0.0 | Yes |
| Application | icewarp | webmail_server | 9.1.0 | Yes |
| Application | icewarp | webmail_server | 9.2.0 | Yes |