CVE-2025-8264: Z-Push IMAP Backend SQLi Vulnerability

CVE-2025-8264 Overview

CVE-2025-8264 is a critical SQL Injection vulnerability affecting Z-Push, an open-source implementation of the Exchange ActiveSync protocol. Versions of the z-push/z-push-dev package prior to 2.7.6 contain unparameterized SQL queries in the IMAP backend, allowing remote attackers to inject malicious SQL commands through the username field during basic authentication.

Critical Impact

This vulnerability enables unauthenticated remote attackers to access, modify, or delete sensitive data from linked third-party databases by exploiting SQL injection through the authentication username field.

Affected Products

• Z-Push (z-push/z-push-dev) versions before 2.7.6
• Z-Push installations utilizing the IMAP backend
• Configurations with IMAP_FROM_SQL_QUERY option enabled

Discovery Timeline

• July 29, 2025 - CVE-2025-8264 published to NVD
• July 29, 2025 - Last updated in NVD database

Technical Details for CVE-2025-8264

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in the IMAP backend component of Z-Push, specifically within the user identity handling functionality. The vulnerability manifests when the IMAP_FROM_SQL_QUERY configuration option is enabled, allowing SQL queries to be constructed with unparameterized user input.

The flaw enables network-based attacks without requiring prior authentication or user interaction, though certain preconditions must be met (specifically, the vulnerable IMAP backend configuration). An attacker can compromise the confidentiality and integrity of linked third-party databases, potentially extracting sensitive user credentials, email metadata, or other stored information.

Root Cause

The root cause of CVE-2025-8264 lies in the improper handling of user-supplied input within the user_identity.php file. When processing authentication requests, the application fails to use parameterized queries or prepared statements when constructing SQL queries that incorporate the username from basic authentication. This allows attackers to escape the intended query context and inject arbitrary SQL commands.

The vulnerable code path is triggered when Z-Push is configured to retrieve user identity information from a SQL database via the IMAP backend, making installations with IMAP_FROM_SQL_QUERY enabled susceptible to exploitation.

Attack Vector

The attack is executed over the network by submitting a specially crafted username during the basic authentication process. An attacker targeting this vulnerability would:

1. Identify a Z-Push installation with the IMAP backend configured to use SQL queries
2. Craft a malicious username containing SQL injection payloads
3. Submit the authentication request with the malicious username
4. The unparameterized query incorporates the malicious input, executing arbitrary SQL commands

The vulnerability allows attackers to bypass authentication mechanisms and directly interact with the backend database, potentially leading to full database compromise. Technical details about the vulnerable code can be found in the GitHub Code Review and the detailed analysis in the Xbow Blog on SQLi.

Detection Methods for CVE-2025-8264

Indicators of Compromise

• Unusual SQL syntax or special characters (e.g., single quotes, semicolons, UNION, SELECT) appearing in authentication logs
• Failed authentication attempts with abnormally long or malformed usernames
• Unexpected database queries or errors in database logs correlating with Z-Push authentication events
• Evidence of data exfiltration or unauthorized database access following Z-Push authentication activity

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns targeting Z-Push authentication endpoints
• Implement database activity monitoring to detect unusual query patterns originating from the Z-Push application
• Configure intrusion detection systems (IDS) with signatures for common SQL injection attack patterns in HTTP Basic Authentication headers
• Review Z-Push access logs for suspicious username patterns containing SQL metacharacters

Monitoring Recommendations

• Enable verbose logging for the Z-Push IMAP backend to capture authentication details
• Configure database audit logging to track all queries executed by the Z-Push application user
• Set up alerts for authentication failures with usernames containing common SQL injection indicators
• Monitor for unauthorized data access or modification in databases linked to Z-Push

How to Mitigate CVE-2025-8264

Immediate Actions Required

• Upgrade Z-Push to version 2.7.6 or later immediately
• Review database logs for evidence of exploitation attempts
• If upgrade is not immediately possible, implement the configuration workaround by changing to default or LDAP backend
• Audit database access permissions for the Z-Push application user and apply principle of least privilege

Patch Information

The vulnerability has been addressed in Z-Push version 2.7.6. The fix implements parameterized queries to prevent SQL injection through the authentication username field. Details about the security patch can be found in GitHub Pull Request #161 and the specific commit implementing the fix. Additional vulnerability information is available in the Snyk Vulnerability Advisory.

Workarounds

• Change the IMAP backend configuration to use default or LDAP instead of SQL queries
• Implement a web application firewall (WAF) rule to filter SQL injection patterns in authentication requests
• Restrict network access to Z-Push authentication endpoints to trusted IP ranges only
• Consider temporarily disabling the IMAP backend until the patch can be applied

# Configuration workaround in backend/imap/config.php
# Option 1: Use default configuration
define('IMAP_DEFAULTFROM', '');

# Option 2: Use LDAP backend
define('IMAP_DEFAULTFROM', 'ldap');