Shennan Wang has reported a vulnerability in U-Mail, which can be exploited by malicious users to bypass certain security restrictions and potentially compromise a vulnerable system.
The vulnerability is caused due to an error within the "edit.php" file while processing HTTP POST parameters. This can be exploited to write arbitrary data to arbitrary files placed under the webroot via specially crafted parameters.
Successful exploitation may allow execution of arbitrary code by e.g. writing arbitrary PHP code to a file having a ".php" extension.
The vulnerability is reported in version 4.91. Other versions may also be affected.
Solution: Restrict access to trusted users only.
Provided and/or discovered by: Shennan Wang
Original Advisory: http://milw0rm.com/exploits/6898
Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this
information to email@example.com