OSVDB ID: 19830

Title: IceWarp WebMail logout.html Traversal Arbitrary File/Directory Deletion

Info

Disclosure
Sep 29, 2005

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 IceWarp Web Mail contains a flaw that allows a remote attacker to delete arbitrary files and directories. The issue is due to the 'logout.html' page not properly sanitizing user input supplied via the 'id' variable.

Classification

 Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Rumored / Private
OSVDB: Web Related

Solution

 Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

IceWarp, Ltd.

Merak Mail Server

 8.4.2r

IceWarp Web Mail

 5.5.1

References

Credit
  • ShineShadow - ss_contactsBrand New Doo Doohotmail.com -


Direct URL: http://osvdb.org/36218