OSVDB ID: 17085

Title: Popper Webmail childwindow.inc.php form Parameter Remote File Inclusion

Info

Disclosure
Jun 01, 2005

Discovery
Mar 07, 2005

Dates

Exploit
Jun 01, 2005

Solution
Unknown

Description

 Popper contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to childwindow.inc.php not properly sanitizing user input supplied to the form variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
OSVDB: Web Related

Solution

 Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

J.P. Bergamin

Popper

 1
1.1x
1.2x
1.3x
1.4
1.41

References

Credit
  • Leon Juranic - infocusinfigo.hr - Infigo Information Security


Direct URL: http://osvdb.org/17085