Login Request a demo
Unscored severity · published Jan 17, 2003
CVE-2003-0025
Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain…
–
CVSS
28%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in db.pgsql, as demonstrated using mailbox.php3.
Exploitation
Is it being used?
Exploit prediction (EPSS)28.0% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imp · Horde
2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +3 more · source: NVD
Affected product
IM
Imp
Horde
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-0025
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-0025
marc.info
http://marc.info/?l=bugtraq&m=104204786206563&w=2
secunia.com
http://secunia.com/advisories/8087
secunia.com
http://secunia.com/advisories/8177
Patch
http://www.debian.org/security/2003/dsa-229
www.securityfocus.com
http://www.securityfocus.com/archive/1/306268
www.securityfocus.com
http://www.securityfocus.com/bid/6559
More from Imp
7.2
CVE-2025-30349
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror…
6.5
CVE-2026-58451
Horde IMP < 7.0.1 Path Traversal via Compose.php img src
6.1
CVE-2026-65053
Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
5.3
CVE-2002-2024
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4)…
–
CVE-2012-6640
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to…