critical9.0Public exploit code
CVE-2008-4932
webmail/modules/filesystem/edit.php in U-Mail Webmail server 4.91 allows remote attackers to overwrite arbitrary files via an absolute pathname in the path par…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- U-Mail Webmail 4.91 - 'edit.php' Arbitrary File Write2008-10-31 · webapps · php · Verified
Impact
webmail/modules/filesystem/edit.php in U-Mail Webmail server 4.91 allows remote attackers to overwrite arbitrary files via an absolute pathname in the path parameter and arbitrary content in the content parameter. NOTE: this can be leveraged for code execution by writing to a file under the web document root.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Comingchina | U-Mail Webmail Server | Version 4.91 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/32540
- http://securityreason.com/securityalert/4565
- http://www.securityfocus.com/archive/1/497961/100/0/threaded
- http://www.securityfocus.com/bid/32013
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46300
- https://www.exploit-db.com/exploits/6898
- http://secunia.com/advisories/32540
- http://securityreason.com/securityalert/4565
- http://www.securityfocus.com/archive/1/497961/100/0/threaded
- http://www.securityfocus.com/bid/32013
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46300
- https://www.exploit-db.com/exploits/6898