Hgiga iSherlock OS Command Injection Vulnerability

A command injection vulnerability has been identified in iSherlock, a product developed by Hgiga, including its components MailSherlock, SpamSherlock, and AuditSherlock, in versions 4.5 and 5.5. This vulnerability allows unauthenticated remote attackers to inject and execute arbitrary operating system commands on the server. The issue has already been exploited, and users are urged to update immediately.

Impact

Exploitation of this vulnerability allows for unauthorized remote execution of operating system commands on the server where iSherlock is installed.

Remediation

Users should update the iSherlock package to version 4.5 (iSherlock-maillog-4.5 to version 137 or later, and iSherlock-smtp-4.5 to version 732 or later) or version 5.5 (iSherlock-maillog-5.5 to version 137 or later, and iSherlock-smtp-5.5 to version 732 or later).