PHPXmail Password Authentication Bypass Vulnerability

Bugtraq ID:	14175
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jul 06 2005 12:00AM
Updated:	Jul 06 2005 12:00AM
Credit:	Discovery of this issue is credited to Steve <[email protected]>.
Vulnerable:	PHPXmail PHPXmail 1.1 PHPXmail PHPXmail 0.7
Not Vulnerable:	PHPXmail PHPXmail 1.2

PHPXmail Password Authentication Bypass Vulnerability

PHPXmail is prone to an authentication bypass vulnerability. Reports indicate that the issue exists in the 'class.xmail.php' script, an attacker that supplies a username and a password of excessive length may bypass the authentication mechanism and gain access to the affected software.

PHPXmail versions 0.7 up to and including version 1.1 are reported to be vulnerable to this issue.

PHPXmail Password Authentication Bypass Vulnerability

No exploit is required.

PHPXmail Password Authentication Bypass Vulnerability

Solution:
This issue has been addressed in version 1.2.


PHPXmail PHPXmail 0.7

• PHPXmail PHPXmail 1.2
  http://prdownloads.sourceforge.net/phpxmail/phpxmail1.2.zip?download

PHPXmail PHPXmail 1.1

• PHPXmail PHPXmail 1.2
  http://prdownloads.sourceforge.net/phpxmail/phpxmail1.2.zip?download

PHPXmail Password Authentication Bypass Vulnerability

References:

• PHPXmail 1.2 Release Notes (PHPXmail)
  
• PHPXmail Homepage (PHPXmail)
  
• PHPXMAIL - Authentication Bypass (Steve )