CVE-2018-17542 SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds

Medium 4.3 Published 11 Feb 2019 Updated 16 Sep 2024

Unauthenticated attackers can extract email subjects from other users via SQL injection in the select_mid parameter.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-17542?

CVE-2018-17542 is a medium-severity SQL injection vulnerability in OAKlouds MailSherlock, published on 11 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.

Weakness: CWE-89

Which versions are affected by CVE-2018-17542?

It affects 1 product.

Products include Hgiga Oaklouds Mailsherlock.

How do I fix CVE-2018-17542?

No fix has been published for CVE-2018-17542 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2018-17542 being exploited?

There is no known exploitation of CVE-2018-17542 in the wild and no public exploit code.

Sources

Also known as GHSA-77r5-xf97-q83j.