Secunia

Two vulnerabilities have been reported in E-mail System, which is a web-based mail system meant for intranet use. A malicious person can reportedly gain knowledge of sensitive information and bypass the login procedure.

An access control error allows anyone to download the database file "message.mdb".

Example:
http://[victim]/[directory]/message.mdb

Missing input validation during the login process can also be exploited by malicious people to bypass the authentication via a classical SQL injection attack.

The vulnerabilities have been reported in version 0.9 Beta. However, other versions may also be affected.

Solution
Restrict access to "message.mdb" and edit the source code so user input is validated properly during the login process.
Further details available in Customer Area

Provided and/or discovered by
G00db0y (Zone-H)

Original Advisory
http://www.zone-h.org/en/advisories/read/id=2709/

Deep Links
Links available in Customer Area