OSVDB ID: 13377 Title: IceWarp WebMail importaction.html Arbitrary File Manipulation |
Info |
|
|
Dates |
||||
|
|
Description |
IceWarp Web Mail contains a flaw that may allow a remote attacker to manipulate arbitrary files on the web server. The issue is due to the importaction.html script not properly sanitizing input passed to the "importfile" parameter. This may allow an attacker to supply any path within the web root and create or view an arbitrary file. |
Classification |
Location:
Remote/Network Access Required
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Available OSVDB: Web Related |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |