Bug found at W3Mail Webmail

Name: W3Mail 1.0.2 Personal and Commercial Version Author: Spencer Miles Problem: Script doesnt check for special metacharacters like &;'"|?^$nr. Any webmail user can execute nix commands on webserver. Exploit: On any field at "Compose Message", put something like: Recipient example [email protected]";...

CVE-2001-1100

sendmessage.cgi in W3Mail 1.0.2, and possibly other CGI programs, allows remote attackers to execute arbitrary commands via shell metacharacters in any field of the 'Compose Message' page...