Neon WebMail Multiple Input Validation Vulnerabilities

vendor:

Neon WebMail

by:

SecurityFocus

7.5

CVSS

HIGH

Arbitrary File Upload, Arbitrary Email Manipulation, SQL Injection, Unauthorized Access, Directory Traversal, HTML Injection

79, 89, 89, 522, 22, 79

CWE

Product Name: Neon WebMail

Affected Version From: 05.06

Affected Version To: 05.07

Patch Exists: YES

Related CWE: N/A

CPE: a:neon_software:neon_webmail

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Neon WebMail Multiple Input Validation Vulnerabilities

Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. An attacker can exploit these issues to compromise the affected application. Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

Mitigation:

Input validation should be performed to ensure that untrusted data is not used to execute unintended commands or access unauthorized resources.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/20109/info
     
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
     
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
     
An attacker can exploit these issues to compromise the affected application.
     
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/updateuser?in_id=admin&in_pass=hacked&
in_name=<script>alert(document.cookie);</script>&in_admin=1&in_showmailcount=10&
in_usecss=1&in_autopoptime=5&in_replysign=&in_isquotation=1&in_formwidth=50&exe=update