Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
RoundCube Webmail‘_session’参数远程安全漏洞
Vulnerability Description
RoundCube Webmail是一款基于浏览器的IMAP客户端（邮件客户端），它支持地址薄管理、信息搜索、拼写检查等。 Roundcube Webmail 0.8.7之前的版本和0.9.5之前的0.9.x版本中的steps/utils/save_pref.inc文件中存在安全漏洞。远程攻击者可借助‘_session’参数利用该漏洞修改配置信息，也可能读取任意文件，实施SQL注入攻击，执行任意代码。
CVSS Information
N/A
Vulnerability Type
N/A