Smartertools.com SmarterMail 7.x (7.1.3876) | Bug : Directory Traversal, OS Command Injection, Other Critcal Vulns
The default installation of SmarterMail is vulnerable to 1 (or more) of the file fuzzing types contained within FuzzDB and Burp Suite Pro 1.3.08 as a baseline analysis for exploit surface modeling. Reduced to exploits, Directory Traversal, OS Injection and Execution. Initial Exploit Requires user-level privs. A malicious user seeking to exploit Browser Clients can launch attacks from the User Home / Public Web Directory utilizing the SSL Certificate of the Host Provider. A malicious user seeking to exploit the Host Server can launch attacks as Local File Inclusion or Remote File Inclusion and perform Operating System Injections and Execution. A malicious user can read and write directories, files and perform malicious operations due to the default configuration of smartermail.
