vendor:
Email Reader
by:
SecurityFocus
7.5
CVSS
HIGH
Remote File Include
98
CWE
Product Name: Email Reader
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002
Cedric Email Reader Remote File Include Vulnerability
It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'emailreader_execute_on_each_page.inc.php' script. Under some circumstances, it is possible for remote attackers to influence the include path for a configuration file to point to an external file on a remote server. If the remote file is a malicious PHP script, this may be exploited to execute arbitrary system commands in the context of the web server. It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker.
Mitigation:
Ensure that the application is not vulnerable to remote file inclusion attacks by validating user-supplied input and restricting the types of files that can be included.
