A vulnerability has been identified in SocketMail, which may be exploited by attackers to execute arbitrary commands. This flaw is due to input validation errors in the "index.php" and "inc-common.php" scripts that do not validate the "site_path" parameter, which could be exploited by remote attackers to include malicious scripts and execute arbitrary commands with the privileges of the web server.
Vulnerable Products
Vulnerable Software: SocketMail Lite version 2.2.6 and priorSocketMail Pro version 2.2.6 and prior
