header-logo
Suggest Exploit
vendor:
Imp
by:
SecurityFocus
7.5
CVSS
HIGH
Insufficient Sanity Checks
20
CWE
Product Name: Imp
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002

Insufficient Sanity Checks

A vulnerability has been discovered in Horde Imp which may allow an attacker to access arbitrary system files. The issue occurs due to insufficient sanity checks on user-supplied URI parameters. By specifying a malicious INBOX file in a request, the contents of the file may be disclosed to a remote attacker. All files would be accessed with the privileges of the user invoking Imp.

Mitigation:

Ensure that user-supplied URI parameters are properly sanitized.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/3067/info

A vulnerability has been discovered in Horde Imp which may allow an attacker to access arbitrary system files. The issue occurs due to insufficient sanity checks on user-supplied URI parameters.

By specifying a malicious INBOX file in a request, the contents of the file may be disclosed to a remote attacker. All files would be accessed with the privileges of the user invoking Imp. 

http://vulnerableserver/horde/imp/mailbox.php?mailbox=/etc/passwd

Navigation

Suggest Exploit

Services By CQR