Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in db.pgsql, as demonstrated using mailbox.php3.

Jouko Pynnonen discovered a problem with IMP, a web-based IMAP mail program. Using carefully crafted URLs a remote attacker is able to inject SQL code into SQL queries without proper user authentication.
Even though results of SQL queries aren't directly readable from the screen, an attacker might update their mail signature to contain wanted query results and then view it on the preferences page of IMP.

The impact of SQL injection depends heavily on the underlying database and its configuration. If PostgreSQL is used, it's possible to execute multiple complete SQL queries separated by semicolons. The database contains session id's so the attacker might hijack sessions of people currently logged in and read their mail. In the worst case, if the hordemgr user has the required privilege to use the COPY SQL command (found in PostgreSQL at least), a remote user may read or write to any file the database user (postgres) can. The attacker may then be able to run arbitrary shell commands by writing them to the postgres user's ~/.psqlrc; they'd be run when the user starts the psql command which under some configurations happens regularly from a cron script.

The remote host is missing the patch for the advisory SUSE-SA:2003:0008 (imp).


IMP is a well known PHP-based web-mail system.
Some SQL-injection vulnerabilities were found in  IMP 2.x that allow an attacker to access the underlying database. No authentication is needed to exploit this bug.
An attacker can gain access to protected information or, in conjunction with PostgreSQL, execute shell commands remotely.

There is no temporary fix known. Please install the new packages from our FTP servers.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

The remote server is running IMP, a web-based mail client.  There is a bug in the installed version which allows an attacker to perform a SQL injection attack using the 'actionID' parameter of the 'mailbox.php3' script.

An attacker may use this flaw to gain unauthorized access to a user mailbox or to take the control of the remote database.

ID	Name	Product	Family	Severity
15066	Debian DSA-229-1 : imp - SQL injection	Nessus	Debian Local Security Checks	high
13773	SUSE-SA:2003:0008: imp	Nessus	SuSE Local Security Checks	high
11488	Horde IMP mailbox.php3 Multiple Parameter SQL Injection	Nessus	CGI abuses	high

Detections

Analytics

CVE-2003-0025

critical

Tenable Plugins

high

high

high