Exploit SquirrelMail 1.2.11 - Multiple Vulnerabilities

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
22793
Проверка EDB
  1. Пройдено
Автор
DR_INSANE
Тип уязвимости
WEBAPPS
Платформа
PHP
CVE
N/A
Дата публикации
2003-06-17
Код:
source: https://www.securityfocus.com/bid/7952/info
  
Multiple vulnerabilities have been reported for Squirrelmail which could allow for information disclosure, data corruption, and privilege escalation.
  
The problems appear to occur due to insufficient sanitization of URI parameters submitted within HTTP requests.
  
*** It has been discovered that all information disclosure and data corruption issues are in fact not vulnerabilities. The issue lies in the default IMAP configuration, allowing a remote authenticated user to specify their local mailbox file. This behaviour is clearly specified in the IMAP FAQ.
  
All actions carried out by an authenticated user are done with their own local system privileges, effectively having no affect on the system. This information has been confirmed by the vendor.
  
It should also be noted that the vendor has announced that the privilege elevation issue is indeed legitimate. In the future this BID will be re-used to cover that vulnerability alone. 


File disclosure:
http://www.example.com/src/read_body.php?mailbox=/etc/passwd&passed_id=1&

File deletion:
http://www.example.com/src/delete_message.php?mailbox=[filehere]&message=1


File download:
http://www.example.com/src/download.php?absolute_dl=true&passed_id=1&passed_ent_id=1&mailbox=/etc/passwd
 
Источник
www.exploit-db.com

Похожие темы