Mailspect Control Panel Multiple Security Vulnerabilities

Bugtraq ID:	68204
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 26 2014 12:00AM
Updated:	Jun 26 2014 12:00AM
Credit:	BGA Team
Vulnerable:
Not Vulnerable:

Mailspect Control Panel Multiple Security Vulnerabilities

Mailspect Control Panel is prone to the following security vulnerabilities:

1. A remote code-execution vulnerability
2 .Multiple arbitrary file-disclosure vulnerabilities
3. A cross-site scripting vulnerability.

An attacker may leverage these issues to to execute arbitrary code in the context of the affected application to view arbitrary local files, gain access to potentially sensitive information or execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials.

Mailspect Control Panel 4.0.5 is vulnerable.

Mailspect Control Panel Multiple Security Vulnerabilities

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Mailspect Control Panel Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Mailspect Control Panel Multiple Security Vulnerabilities

References: