Secunia

Tan Chew Keong has reported two vulnerabilities in DeskNow Mail and Collaboration, which can be exploited by malicious users to delete arbitrary files and potentially compromise a vulnerable system.

1) Input passed to the "AttachmentsKey" parameter within the webmail functionality when handling attachment uploads is not sanitised properly. This can be exploited via directory traversal attacks to upload files to arbitrary locations on the server.

Also, when the user logs out and back in, all files and directories in the specified directory will be recursively deleted.

2) Input passed to the "select_file" parameter within the document repository file deletion functionality can be exploited via directory traversal attacks to delete arbitrary files on the server.

The vulnerabilities have been reported in version 2.5.12 and partially in 2.5.13. Prior versions may also be affected.

Solution
Update to version 2.5.14 or later.
Further details available in Customer Area

Provided and/or discovered by
Tan Chew Keong

Changelog
Further details available in Customer Area

Original Advisory
http://www.security.org.sg/vuln/desknow2512.html

Deep Links
Links available in Customer Area