Absolute path directory traversal vulnerability in (a) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (b) VisNetic MailServer before 8.5.0.5 allows remote attackers to include arbitrary files via a full Windows path and drive letter in the (1) language parameter in accounts/inc/include.php and (2) lang_settings parameter in admin/inc/include.php, which is not properly sanitized by the securepath function, a related issue to CVE-2005-4556.

The remote host is running VisNetic MailServer, a commercial mail server for the Microsoft platform.  The version of VisNetic MailServer installed on the remote host fails to sanitize user-supplied input to the 'lang_settings' parameter of the 'accounts/inc/include.php' and 'admin/inc/include.php' scripts before using it to include PHP code.  An unauthenticated attacker may be able to exploit these flaws to view arbitrary files on the remote host or to execute arbitrary PHP code after injecting it into the mail server's log file.

The remote host is running IceWarp Web Mail, a webmail product written in PHP that is distributed as a standalone application and also bundled with VisNetic Mail Server and Merak Mail Server.  The version of IceWarp Web Mail installed on the remote host fails to sanitize user-supplied input to the 'lang_settings' parameter of the 'accounts/inc/include.php' and 'admin/inc/include.php' scripts before using it to include PHP code.  An unauthenticated attacker may be able to exploit these flaws to view arbitrary files on the remote host or to execute arbitrary PHP code after injecting it into the mail server's log file. 

The remote host is running IceWarp Web Mail, a webmail product written in PHP that is distributed as a standalone application and is also bundled with VisNetic Mail Server and Merak Mail Server. 

The version of IceWarp Web Mail installed on the remote host fails to sanitize user-supplied input to the 'lang_settings' parameter of the 'accounts/inc/include.php' and 'admin/inc/include.php' scripts before using it to include PHP code.  An unauthenticated attacker may be able to exploit these flaws to view arbitrary files on the remote host or to execute arbitrary PHP code, for example, after injecting it into the mail server's log file. 

In addition, the /mail/settings.html script has been reported vulnerable to a traversal issue via the 'language' parameter. However, Nessus has not checked for this.

ID	Name	Product	Family	Type	Severity
3690	VisNetic MailServer < 8.5.0.5 lang_settings Parameter Remote File Inclusion	Nessus Network Monitor	SMTP Servers		medium
3688	IceWarp < 5.6.1 lang_settings Parameter Remote File Inclusion (deprecated)	Nessus Network Monitor	CGI		medium
22079	IceWarp Multiple Script Remote File Inclusion	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2006-0817

high

Tenable Plugins

medium

medium

medium