IlohaMail Forged GET/POST Arbitrary Contacts Deletion

medium Nessus Plugin ID 14633

Language:

Synopsis

The remote host is running a webmail application that is is affected by a contacts deletion vulnerability.

Description

The target is running at least one instance of IlohaMail version 0.7.9-RC2 or earlier. Such versions contain a flaw that enables an authenticated user to delete contacts belonging to any user provided the DB-based backend is used to store contacts. The flaw arises because ownership of 'delete_item' is not checked when deleting entries in include/save_contacts.MySQL.inc.

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of IlohaMail
***** installed there.

Solution

Upgrade to IlohaMail version 0.7.9 or later.

Plugin Details

Severity: Medium

ID: 14633

File Name: ilohamail_contacts_deletion.nasl

Version: 1.11

Type: remote

Family: CGI abuses

Published: 9/2/2004

Updated: 8/15/2022

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

Vulnerability Publication Date: 1/23/2003

Detections

Analytics