PT-2020-12857 · Titan · Spamtitan

Published 2020-09-17 · Updated 2021-07-21 · CVE-2020-11804

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Titan SpamTitan version 7.07

Description An issue was discovered due to improper sanitization of the parameter quid, used in the page "mailqueue.php", which can lead to code injection. The input for this parameter is provided directly by an authenticated user via an HTTP GET request.

Recommendations For Titan SpamTitan version 7.07, consider restricting access to the "mailqueue.php" page until a fix is available, and avoid using the parameter quid in this context to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-11804

Affected Products

Spamtitan

References · 8

• 🔥 http://packetstormsecurity.com/files/159218/SpamTitan-7.07-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48817 · Exploit
• 🔥 https://sensepost.com/blog/2020/clash-of-the-spamtitan · Exploit
• https://osv.dev/vulnerability/CVE-2020-11804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11804 · Security Note
• https://spamtitan.com · Vendor Advisory
• https://twitter.com/felmoltor · Note
• https://github.com/felmoltor · Note