3R Soft MailStudio 2000 Multiple Vulnerabilities

MailStudio 2000 is vulnerable to multiple attacks.

It is possible for a remote user to gain read access to all files located on the server via the usage of the "/.." string passed to a CGI, thereby compromising the confidentiality of other users email and password, as well as other configuration and password files on the system.

It is also possible to set a password for those system user accounts which don't have one in place (ex: operator, gopher etc).

There is also a input validation vulnerability in the userreg.cgi. This CGI uses a shell to execute certain commands. Passing any command directly after %0a in the arguments of the CGI will allow a remote user to execute the commands as root.

userreg.cgi also has an unchecked which could allow remote attackers to execute arbitrary code as root.


Privacy Statement
Copyright 2010, SecurityFocus