|
Description
|
|
Multiple vulnerabilities have been identified in SquirrelMail, which could be exploited by attackers to bypass security restrictions, gain knowledge of sensitive information or compromise a vulnerable web server.
The first issue is caused by input validation errors in the "functions/global.php" and "contrib/decrypt_headers.php" scripts when processing user-supplied data, which could allow cross site scripting attacks.
The second vulnerability is caused by an input validation error in the "map_yp_alias()" [functions/imap_general.php] function when processing the "username" parameter, which could be exploited to inject and execute arbitrary shell commands.
The third issue is caused by an error when regenerating and handling session IDs, which could allow session fixation attacks.
The fourth vulnerability is caused by an input validation error when processing HTML emails containing CSS positioning, which could be exploited to overlay SquirrelMail content and conduct phishing attacks.
|
