CVE-2025-56425
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
3Tags
Description
An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version 11.0.0.183 and earlier of enaio 11.0, and in the AppConnctor component version 11.10.0.183 and earlier of enaio 11.10. The vulnerability allows authenticated remote attackers to inject arbitrary SMTP commands via crafted input to the /osrest/api/organization/sendmail endpoint
Analysis
enaio document management AppConnector (multiple versions) has SMTP command injection via the /osrest/api/organization/s endpoint. Authenticated attackers can inject arbitrary SMTP commands, potentially sending spam or phishing emails through the organization's mail server. PoC available.
Technical Context
The endpoint concatenates user input into SMTP commands (CWE-77) sent to the configured mail server. An authenticated attacker can inject SMTP verbs and addresses to send emails as any organizational address.
Affected Products
enaio AppConnector 10.10 (<=10.10.0.183), 11.0 (<=11.0.0.183), 11.10 (<=11.10.0.183)
Remediation
Update the AppConnector component. Implement SMTP command sanitization. Monitor outgoing email for anomalous patterns.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today