SQL Injection Vulnerability in Roundcube Email Client
CVE-2021-44026

9.8CRITICAL

Key Information:

Vendor: Roundcube
Status: Webmail
Vendor: CVE Published:; 19 November 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 71%🦅 CISA Reported

What is CVE-2021-44026?

A potential SQL injection vulnerability exists in Roundcube Email Client versions before 1.3.17 and 1.4.12. This flaw can be exploited via the 'search' or 'search_params' parameters, allowing unauthorized access to the database and leakage of sensitive information. Users are encouraged to upgrade to the latest versions to mitigate the risk.

CISA has reported CVE-2021-44026

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2021-44026 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

roundcube-cve-2021-44026
Created by pentesttoolscom