title: HGiga MailSherlock - SQL Injection
description: HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject SQL commands to read, modify, and delete the database.
problem types: CWE-89 SQL Injection
affected:
{
vendor: HGiga
product: MailSherlock
versions:
version: iSherlock-query-4.5, status: affected, lessThanOrEqual: iSherlock-query-4.5-167, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
]
solutions: Update MailSherlock package version to iSherlock-query-4.5-168.386