NetSight
IP …
medium4.3Public exploit code

CVE-2005-2095

options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which allows remote attackers to modify or r…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS) attacks, and write arbitrary files.

Affected products

VendorProductAffected versions
SquirrelmailSquirrelmail
Versions 1.0.4, 1.0.5, 1.2.0, 1.2.1, 1.2.2, 1.2.3

References