IlohaMail Attachment Arbitrary File Create/Overwrite

medium Nessus Plugin ID 14632

Language:

Synopsis

The remote web server is hosting a PHP application that is affected by a file creation vulnerability.

Description

The target is running at least one instance of IlohaMail version 0.7.9-RC2 or earlier. Such versions do not properly check the upload path for file attachments, which could allow an attacker to place a file on the target in a location writable by the web user if the file-based backend is in use.

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of IlohaMail
***** installed there.

Solution

Upgrade to IlohaMail version 0.7.9 or later.

Plugin Details

Severity: Medium

ID: 14632

File Name: ilohamail_attachment_upload.nasl

Version: 1.14

Type: remote

Family: CGI abuses

Published: 9/2/2004

Updated: 8/15/2022

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 2/6/2003

Reference Information

BID: 6740

Detections

Analytics