AMSS++ SQL Injection Vulnerability in Mail Module

A SQL injection vulnerability has been identified in AMSS++ version 4.31, specifically within the mail module's maildetail.php script. The vulnerability arises from the 'id' parameter, which attackers can manipulate to inject malicious SQL queries. This exploitation could lead to unauthorized access or modification of database contents.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could result in unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, navigate to the maildetail.php script within the mail module. Append the 'id' parameter to the URL and inject a crafted SQL query. The application will process the injected SQL, potentially allowing access to or modification of the database.