CVE-2025-8264 Details
Description
Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modify or delete sensitive data from a linked third-party database. **Note:** This vulnerability affects Z-Push installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured. Mitigation Change configuration to use the default or LDAP in backend/imap/config.php php define('IMAP_DEFAULTFROM', ''); or php define('IMAP_DEFAULTFROM', 'ldap');
A SQL injection vulnerability has been identified in Z-Push versions prior to 2.7.6, specifically within the IMAP backend. The issue arises from unparameterized SQL queries, which allow attackers to inject malicious commands by manipulating the username field during basic authentication. This exploitation could lead to unauthorized access and modification or deletion of sensitive data in a connected third-party database. The vulnerability is present in Z-Push installations that use the IMAP backend and have the IMAP_FROM_SQL_QUERY option enabled.
Users are advised to upgrade Z-Push to version 2.7.6 or later. Additionally, for those using the IMAP backend, the configuration should be changed to the default or LDAP option in the backend/imap/config.php file.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2025CISA-ADP
Assessed Jul 29, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Z-Hub/Z-Push/blob/af25a2169a50d6e05a5916d1e8b2b6cd17011c98/src/backend/imap/user_identity.php%23L211C9-L214C25 | [email protected] | Broken LinkSource CodeVendor |
| https://github.com/Z-Hub/Z-Push/pull/161 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Z-Hub/Z-Push/pull/161/commits/f981d515a35ac4c303959af21dce880a5db02786 | [email protected] | Source CodeVendor |
| https://security.snyk.io/vuln/SNYK-PHP-ZPUSHZPUSHDEV-10908180 | [email protected] | AdvisoryBundleRemedy |
| https://xbow.com/blog/xbow-zpush-sqli/ | [email protected] | ExploitTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Z-Hub Z-Push | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Jul 29, 2025 | CVE Modified | CISA-ADP |
| Jul 29, 2025 | New CVE Received | [email protected] |