Critical · published July 29, 2025
🚨 A sneaky SQL Injection lurking in Z-Push affects versions before 2.7.6! An attacker can twist the username field like a magician misdirecting your attention — and gain access to sensitive data. 🔥 Think of this vulnerability as a restaurant where a diner can sneakily change their order at the counter. Instead of just getting a new dish, they could manipulate the kitchen staff to mix up all kinds of sensitive recipes, leading to a culinary disaster! An attacker exploiting this flaw could access, modify, or downright delete sensitive data from a linked third-party database. This could result in absolutely devastating data loss or unauthorized access, leaving your organization vulnerable and exposed. The stakes are high!
Think of this vulnerability as a restaurant where a diner can sneakily change their order at the counter. Instead of just getting a new dish, they could manipulate the kitchen staff to mix up all kinds of sensitive recipes, leading to a culinary disaster! The SQL Injection vulnerability arises from unparameterized queries in the IMAP backend of Z-Push, allowing attackers to inject malicious SQL commands by manipulating the username during basic authentication.
An attacker exploiting this flaw could access, modify, or downright delete sensitive data from a linked third-party database. This could result in absolutely devastating data loss or unauthorized access, leaving your organization vulnerable and exposed. The stakes are high! To mitigate this vulnerability, change your configuration to use the default setting by updating your backend/imap/config.php: set 'IMAP_DEFAULTFROM' to an empty value or to 'ldap'. This step is crucial to safeguard your data! You've got this! Follow these steps, and you'll have your Z-Push installation secured in no time. 🛡️