high7.5Public exploit code

CVE-2006-0757

Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via (1) the contactgroupid parameter i…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

HiveMail 1.2.2/1.3 - 'folders.update.php?folderid' Arbitrary PHP Command Execution2006-02-11 · webapps · php · Verified
HiveMail 1.2.2/1.3 - 'addressbook.update.php?contactgroupid' Arbitrary PHP Command Execution2006-02-11 · webapps · php · Verified
HiveMail 1.3 - 'addressbook.add.php' Remote Code Execution2006-05-06 · webapps · php · Verified

Impact

Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts, as demonstrated by an addressbook.update.php request with a contactgroupid value of phpinfo() preceded by facilitators.

Affected products

Vendor	Product	Affected versions
Hivemail	Hivemail	Versions 1.1, 1.1.1, 1.2, 1.2.1_beta1, 1.2.1_rc, 1.2.2

Public exploit code

Impact

Affected products

References