Russcom Network LoginPHP Open EMail Relay Vulnerability

Bugtraq ID:	17787
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 02 2006 12:00AM
Updated:	May 03 2006 03:45AM
Credit:	Nomenumbra is credited with the discovery of this issue.
Vulnerable:	Russcom Network loginphp 0
Not Vulnerable:

Russcom Network LoginPHP Open EMail Relay Vulnerability

Th loginphp script is susceptible to a remote open-email-relay vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input before using it to generate email messages.

This issue allows remote attackers to use webservers that are hosting the vulnerable application to send arbitrary unsolicited bulk email. Attackers may also forge email messages that originate from a trusted mail server.

Russcom Network LoginPHP Open EMail Relay Vulnerability

This issue can be exploited through a web client.

Russcom Network LoginPHP Open EMail Relay Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Russcom Network LoginPHP Open EMail Relay Vulnerability

References:

• Vendor Homepage (Russcom Network)
  
• Russcom.net Loginphp multiple vulnerabilties (Nomenumbra)