TI-2018-12500 Aliases CVE-2018-17542 GHSA-77r5-xf97-q83j

SQL injection in HGiga MailSherlock

LOW 27CWE-89Published 2019-02-11 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.

Why it matters now

EPSS 0.01229 69th percentileScored 2026-11-07

Fix Fixed MailSherlock (OAKlouds): 1.5.235

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HGiga	MailSherlock	before 1.5.235	1.5.235	Patch available	CNA

MailSherlock VendorHGiga Affected before 1.5.235 Fixed in 1.5.235 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hgiga:oaklouds_mailsherlock::::::::	before 1.5.235	Vulnerable	HGiga

cpe:2.3:a:hgiga:oaklouds_mailsherlock:*:*:*:*:*:*:*:* Versions before 1.5.235 Vulnerable ·HGiga

Remediation

Fix · CNA MailSherlock (OAKlouds) Fixed in 1.5.235

Timeline

2026-10-02 Threatist record created from CVE-2018-17542
2026-10-03 Alias added: GHSA-77r5-xf97-q83j

References

Advisory 2

TI-2023-10341 HGiga MailSherlock - Command Injection CVSS 3.1HIGH 7.2
TI-2023-10340 HGiga MailSherlock - SQL Injection CVSS 3.1HIGH 7.2
TI-2023-10342 HGiga MailSherlock - Broken Access Control CVSS 3.1MEDIUM 5.3
TI-2023-10339 HGiga MailSherlock - Reflected XSS CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences