PT-2006-1765 · Squishdot · Squishdot

Published 2006-02-15 · Updated 2017-07-20 · CVE-2006-0712

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Squishdot versions 1.5.0 and earlier

Description The issue concerns a problem with the mail html template where it does not properly validate the email and title variables. This allows remote attackers to bypass spam filters by injecting SMTP headers, likely due to a CRLF injection vulnerability.

Recommendations For Squishdot versions 1.5.0 and earlier, as a temporary workaround, consider validating the email and title variables to prevent CRLF injection. Restrict access to the mail html template to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-0712

Affected Products

Squishdot

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-0712 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24659 · Note
• http://securityfocus.com/bid/16667 · Note
• http://secunia.com/advisories/18868 · Note
• http://squishdot.org/1139510883 · Note
• http://vupen.com/english/advisories/2006/0551 · Note