PT-2008-6108 · U Mail · U-Mail Webmail Server

Shennan Wang · Published 2008-11-05 · Updated 2018-10-11 · CVE-2008-4932

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions U-Mail Webmail server version 4.91

Description The issue allows remote attackers to overwrite arbitrary files by providing an absolute pathname in the path parameter and arbitrary content in the content parameter in the webmail/modules/filesystem/edit.php file. This can be leveraged for code execution by writing to a file under the web document root.

Recommendations For U-Mail Webmail server version 4.91, restrict access to the webmail/modules/filesystem/edit.php file to minimize the risk of exploitation. Avoid using the path and content parameters in this file until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-4932

Affected Products

U-Mail Webmail Server

References · 7

• 🔥 https://exploit-db.com/exploits/6898 · Exploit
• 🔥 http://securityfocus.com/bid/32013 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4932 · Security Note
• http://securityfocus.com/archive/1/497961/100/0/threaded · Note
• http://secunia.com/advisories/32540 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46300 · Note
• http://securityreason.com/securityalert/4565 · Note