Progressive Robot hMailServer: SQL injection in database layer (CVE-2026-126617)

Progressive Robot hMailServer 6.0.0-B1 through 6.2.18 contains a SQL injection vulnerability in the SQLStatement::GenerateFromCommand function. The application performs improper parameter binding by performing string replacements on SQL statements rather than using bound parameters. When configured to use MySQL, MariaDB, or PostgreSQL, an attacker can provide input containing parameter names that, when processed, escape the intended SQL literal and inject arbitrary SQL commands. The injected code executes with the privileges of the database service account. SQL Server and SQL Server Compact are not affected as they correctly utilize bound parameters.

Impact

Successful exploitation allows for unauthorized execution of SQL commands with the privileges of the mail server database account. On PostgreSQL, the vulnerability supports command stacking, enabling subsequent arbitrary SQL statements. On MySQL and MariaDB, exploitation is limited to the scope of the original statement.

Recommendation

• Upgrade hMailServer to a version beyond 6.2.18 immediately once a security update is released by Progressive Robot.
• Audit database user privileges to follow the principle of least privilege, ensuring the database account used by hMailServer has the minimum necessary access to perform its functions.
• If the environment permits, transition to SQL Server or SQL Server Compact to utilize bound parameters, as these configurations are not susceptible to this specific flaw.
• Review mail server logs for anomalous recipient addresses or metadata patterns that indicate injection attempts.