CVE-2005-4556 PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when register_globals is enabled, allows remote att...
HighCVSS 7.5
EPSS 10.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when register_globals is enabled, allows remote attackers to include arbitrary local and remote PHP files via a URL in the (1) lang_settings and (2) language parameters in (a) accounts/inc/include.php and (b) admin/inc/include.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| deerfield visnetic mail server | = 8.3.0_build1 | No fix listed |
| icewarp web mail | = 5.5.1 | No fix listed |
| merak mail server | = 8.3.0r | No fix listed |
References
- 20051227 Secunia Research: IceWarp Web Mail Multiple File mailing-list
- 17046 exploit patch third-party-advisory vendor-advisory
- 17865 third-party-advisory
- secunia.com exploit vendor-advisory
- 1015412 vdb-entry
- 22077 vdb-entry
- 22078 vdb-entry
- 20051227 Secunia Research: IceWarp Web Mail Multiple File InclusionVulnerabilities mailing-list
- 16069 exploit vdb-entry