Squirrelmail CVE-2017-7692 Command Injection Vulnerability
BID:98067
Info
Squirrelmail CVE-2017-7692 Command Injection Vulnerability
| Bugtraq ID: | 98067 |
| Class: | Unknown |
| CVE: |
CVE-2017-7692 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 19 2017 12:00AM |
| Updated: | May 23 2017 04:27PM |
| Credit: | Filippo Cavallarin |
| Vulnerable: |
SquirrelMail SquirrelMail 1.4.21 SquirrelMail SquirrelMail 1.4.20 SquirrelMail SquirrelMail 1.4.19 SquirrelMail SquirrelMail 1.4.18 SquirrelMail SquirrelMail 1.4.17 SquirrelMail SquirrelMail 1.4.16 SquirrelMail SquirrelMail 1.4.15 SquirrelMail SquirrelMail 1.4.12 SquirrelMail SquirrelMail 1.4.11 SquirrelMail SquirrelMail 1.4.2 SquirrelMail SquirrelMail 1.4.1 SquirrelMail SquirrelMail 1.4 SquirrelMail SquirrelMail 1.2.11 SquirrelMail SquirrelMail 1.2.10 SquirrelMail SquirrelMail 1.2.9 SquirrelMail SquirrelMail 1.2.8 SquirrelMail SquirrelMail 1.2.7 SquirrelMail SquirrelMail 1.2.6 SquirrelMail SquirrelMail 1.2.5 SquirrelMail SquirrelMail 1.2.4 SquirrelMail SquirrelMail 1.2.3 SquirrelMail SquirrelMail 1.2.2 SquirrelMail SquirrelMail 1.2.1 SquirrelMail SquirrelMail 1.4.22 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: | |
Discussion
Squirrelmail CVE-2017-7692 Command Injection Vulnerability
Squirrelmail is prone to a remote command-injection vulnerability.
Successful exploit allows an attacker to inject and execute arbitrary commands in context of the affected application.
Squirrelmail version 1.4.22 and prior are vulnerable.
Squirrelmail is prone to a remote command-injection vulnerability.
Successful exploit allows an attacker to inject and execute arbitrary commands in context of the affected application.
Squirrelmail version 1.4.22 and prior are vulnerable.
Exploit / POC
Squirrelmail CVE-2017-7692 Command Injection Vulnerability
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
Solution / Fix
Squirrelmail CVE-2017-7692 Command Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Squirrelmail CVE-2017-7692 Command Injection Vulnerability
References:
References:
- SquirrelMail Homepage (SquirrelMail)
- Bug 1445165 - (CVE-2017-7692) CVE-2017-7692 squirrelmail: Insufficient escaping (Redhat)
- CVE-2017-7692: Squirrelmail 1.4.22 Remote Code Execution (Seclists.org)
- Register_globals does not have to be on for this issue. (squirrelmail)