CVE-2017-7692

🗓️ 20 Apr 2017 14:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 192 Views🌐 WEB

SquirrelMail 1.4.22 allows post-auth remote code execution via mishandling of sendmail.cf file in popen call

Reporter	Title	Published	Views	Family All 48
zdt	Squirrelmail 1.4.22 Remote Code Execution Exploit	20 Apr 201700:00	–	zdt
Circl	CVE-2017-7692	20 Mar 202502:24	–	circl
CNVD	Squirrelmail Remote Code Execution Vulnerability	20 Apr 201700:00	–	cnvd
Cvelist	CVE-2017-7692	20 Apr 201714:00	–	cvelist
Debian	[SECURITY] [DLA 941-1] squirrelmail security update	15 May 201709:16	–	debian
Debian	[SECURITY] [DSA 3852-1] squirrelmail security update	13 May 201711:18	–	debian
Debian	[SECURITY] [DSA 3852-1] squirrelmail security update	13 May 201711:18	–	debian
Tenable Nessus	Debian DLA-941-1 : squirrelmail security update	16 May 201700:00	–	nessus
Tenable Nessus	Debian DSA-3852-1 : squirrelmail - security update	15 May 201700:00	–	nessus
Tenable Nessus	Fedora 24 : squirrelmail (2017-0b6da97aa5)	5 Jun 201700:00	–	nessus

NVD

Node

Source	Link
securitytracker	www.securitytracker.com/id/1038312
openwall	www.openwall.com/lists/oss-security/2017/04/19/6
securityfocus	www.securityfocus.com/bid/98067
exploit-db	www.exploit-db.com/exploits/41910/
legalhackers	www.legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html
openwall	www.openwall.com/lists/oss-security/2017/04/27/1
debian	www.debian.org/security/2017/dsa-3852
security	www.security.gentoo.org/glsa/201709-13

Parameter	Position	Path	Description	CWE
new_email_address	request body	/src/options.php?optpage=personal	Post-auth remote code execution via craft email address to trigger -C option in sendmail configuration.	CWE-20
attachfile	request body	/src/compose.php	Upload of a malicious sendmail.cf as an attachment leading to RCE via popen call in sendmail processing.	CWE-20

17 Jun 2026 01:24Current

9High risk

Vulners AI Score9

CVSS 38.8

CVSS 29

EPSS0.32156