Remote Code Execution (RCE)

zetacomponents/mail is vulnerable to remote code execution RCE attacks. The attacks can be launched using a malicious email address for example: -X/path/to/wwwroot/file.php since the application does not restrict the set of characters used in ezcMail returnPath property...

Zeta Components Mail 1.8.1 - Remote Code Execution

Zeta Components Mail 1.8.1 - Remote Code Execution Vendor: Zeta Components module: Mail, returnPath-email”; If attacker assign email address like: '[email protected] -X/var/www/html/cache/exploit.php' and inject payload in mail body, sendmail will transfer log-X into...

CVE-2017-15806: Improper Control of Generation of Code

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one...