VULHUB ™

Mailnews.cgi fails to check remote user-supplied input for shell metacharacters. A remote attacker can insert a new user to the mailnews' user file which includes malicious shell commands in the username field. Upon displaying this this data, the embedded commands will execute with the privileges of the webserver process.

Mailnews.cgi fails to check remote user-supplied input for shell metacharacters. A remote attacker can insert a new user to the mailnews' user file which includes malicious shell commands in the username field. Upon displaying this this data, the embedded commands will execute with the privileges of the webserver process.