RoundCube Webmail <= 0.2b Remote Code Execution Exploit

Exploit for unknown platform in category web applications ======================================================= RoundCube Webmail echoiniget'disablefunctions'; exec, system PHP passthru"id; uname -a"; uid=666www-data gid=666www-data groups=666www-data Linux mail 2.6.28 0 Sun Jan 01 10:05:33 CET...

RoundCube Webmail <= 0.2-3 beta Code Execution Vulnerability

Exploit for unknown platform in category web applications ============================================================ RoundCube Webmail search, $this-replace, $text; Some patterns in $this-search allow interpret PHP code using the "e" flag, i.e.: '/href="|'^"'+\1^.+?/ie', // '/.+?/ie', //...

Roundcube Webmail 0.2b - Remote Code Execution

!/bin/sh I was hoping the PoC would not appear so soon, but now that it is out, i thought i might as well publish my real exploit. Hunger http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619 FOR LEARNING PURPOSES ONLY! PHP echoiniget'disablefunctions'; exec, system PHP passthru"id; uname...

Roundcube Webmail 0.2-3 Beta - Code Execution

Roundcube Webmail 0.2-3 Beta - Code Execution Public Release Date of POC: 2008-12-22 Author: Jacobo Avariento Gimeno Sofistic CVE id: CVE-2008-5619 Bugtraq id: 32799 Severity: Critical Vulnerability reported by: RealMurphy Intro ---- Roundcube Webmail is a browser-based IMAP client that uses...

[SECURITY] Fedora 10 Update: roundcubemail-0.2-5.beta.fc10

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] Fedora 8 Update: roundcubemail-0.2-5.beta.fc8

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

Hardcoded credentials

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail roundcubemail 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the pregreplace function with t...

Design/Logic Flaw

RoundCube Webmail roundcubemail before 0.2-beta allows remote attackers to cause a denial of service memory consumption via crafted size parameters that are used to create a large quota image...

DEBIAN-CVE-2008-5619

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail roundcubemail 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the pregreplace function with t...

CVE-2008-5619

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail roundcubemail 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the pregreplace function with t...

CVE-2008-5620

RoundCube Webmail roundcubemail before 0.2-beta allows remote attackers to cause a denial of service memory consumption via crafted size parameters that are used to create a large quota image...

CVE-2008-5619

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail roundcubemail 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the pregreplace function with t...

CVE-2008-5619

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail roundcubemail 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the pregreplace function with t...

CVE-2008-5620

RoundCube Webmail roundcubemail before 0.2-beta allows remote attackers to cause a denial of service memory consumption via crafted size parameters that are used to create a large quota image...

DEBIAN-CVE-2008-5620

RoundCube Webmail roundcubemail before 0.2-beta allows remote attackers to cause a denial of service memory consumption via crafted size parameters that are used to create a large quota image...

CVE-2008-5620

RoundCube Webmail roundcubemail before 0.2-beta allows remote attackers to cause a denial of service memory consumption via crafted size parameters that are used to create a large quota image...

CVE-2008-5619

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail roundcubemail 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the pregreplace function with t...

CVE-2008-5619

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail roundcubemail 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the pregreplace function with t...

CVE-2008-5620

RoundCube Webmail roundcubemail before 0.2-beta allows remote attackers to cause a denial of service memory consumption via crafted size parameters that are used to create a large quota image...

CVE-2008-5620

CVE-2008-5620 affects RoundCube Webmail (roundcubemail) prior to 0.2-beta. The vulnerability allows remote attackers to cause a denial of service via crafted size parameters used to generate a quota image, leading to memory consumption. Public references in the initial entry point to a DoS scenar...