---
id: 5215
title: "When the Heat Gets to Your Database: A Refreshing SQL Injection Discovery in Z-Push"
source_domain: xbow.com
source_url: "https://xbow.com/blog/xbow-zpush-sqli"
published_at: "2025-07-10T12:00:00Z"
tags: ["vulnerability-research", "sql-injection", "web-security", "authentication", "z-push", "activesync"]
phying_url: "https://phying.com/item/5215"
lang: en
---

# When the Heat Gets to Your Database: A Refreshing SQL Injection Discovery in Z-Push

## Summary

Recounts XBOW's SQL injection discovery in a Z-Push ActiveSync server: after URL, header and XML attempts failed, the hunt pivoted to the Basic Authentication mechanism, where the flaw surfaced.

## Intelligence Metadata

- **Sources:** xbow.com
- **Published:** 2025-07-10T12:00:00Z
- **Original:** https://xbow.com/blog/xbow-zpush-sqli
- **Phying News:** https://phying.com/item/5215