Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands via the id parameter in message.php, or (2) modify certain mail message headers via numerous parameters in write.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Instant Web Mail POP命令执行漏洞
Vulnerability Description
Instant Web Mail是一款免费的基于WEB的POP邮件客户端，由PHP实现，运行在Linux和多种Unix系统平台下，也可以运行在Windows平台下。 Instant Web Mail对用户提交内容缺少充分过滤可导致POP命令可执行。 Instant Web Mail的command()是发送POP3命令到POP3服务器的函数，允许嵌入CR和LF字符，攻击者可以在CR和LF字符后增加其他的POP3请求，通过构建包含恶意POP3命令的URL连接发送给目标用户，当用户使用Instant Web
CVSS Information
N/A
Vulnerability Type
N/A