CVE-2004-1993 The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell metacharacters such as "`" (backticks) in...
HighCVSS 10.0
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell metacharacters such as "`" (backticks) in the password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| omail webmail | = 0.97.3 | No fix listed |
| omail webmail | = 0.98.3 | No fix listed |
| omail webmail | = 0.98.5 | No fix listed |
References
- 20040504 remote root exec vulnerability in omail mailing-list
- 9585 third-party-advisory vendor-advisory
- 10274 vdb-entry vendor-advisory
- omailwebmail-checklogin-code-execution(12948) vdb-entry