Three vulnerabilities have been reported in SquirrelMail, which can be exploited by malicious users to manipulate certain information, and by malicious people to conduct cross-site scripting attacks and compromise a vulnerable system.

1) Input passed to the "optpage" parameter in "options.php" is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

The vulnerability has been reported in version 1.2.7 and prior.

2) Input passed to the "DOCUMENT_ROOT" parameter in "redirect.php" isn't properly verified before being used to include files. This can be exploited to include arbitrary files from external and local resources.

Successful exploitation requires that "register_globals" is enabled.

The vulnerability has been reported in version 1.2.6.

3) Input passed to the "subject" parameter in "compose.php" isn't properly sanitised before being used to send mails. This can be exploited to inject arbitrary SMTP commands.

The vulnerability has been reported in version 1.2.7 and prior.

Solution
Update to version 1.2.8 or later.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) DarC KonQuesT
2) Grant Hollingworth
3) Vicente Aguilera Diaz

Changelog
Further details available to Secunia VIM customers

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers