Remote code execution

2008-11-0515:00:00

PRIOn knowledge base

www.prio-n.com

8 High

AI Score

Confidence

Low

0.046 Low

EPSS

Percentile

92.6%

JSON

webmail/modules/filesystem/edit.php in U-Mail Webmail server 4.91 allows remote attackers to overwrite arbitrary files via an absolute pathname in the path parameter and arbitrary content in the content parameter. NOTE: this can be leveraged for code execution by writing to a file under the web document root.

CPENameOperatorVersion
u-mail_webmail_servereq4.91

CPE	Name	Operator	Version
	u-mail_webmail_server	eq	4.91

References

secunia.com/advisories/32540

securityreason.com/securityalert/4565

www.securityfocus.com/archive/1/497961/100/0/threaded

www.securityfocus.com/bid/32013

exchange.xforce.ibmcloud.com/vulnerabilities/46300

www.exploit-db.com/exploits/6898