Dr_insane has reported a security issue in Magic Winmail Server, allowing malicious people to see the installation path.

The problem is that input passed to the "keyword" parameter in "ldaplib.php" isn't properly verified. This can be exploited by malicious people by supplying illegal values / characters.

The problem has been reported in version 3.6. Other versions may also be affected.

Solution
Wait for an update or edit the source code to ensure that input is properly verified.

Provided and/or discovered by
Dr_insane

Original Advisory
http://members.lycos.co.uk/r34ct/main/ldaplib/ldaplib.php%20reveal%20local%20path%20of%20Winmail%203.6%20webmail%20directory.txt

Deep Links
Links available in Customer Area