Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Vulnerability Title
ImapEngine 安全漏洞
Vulnerability Description
ImapEngine是DirectoryTree开源的一个邮箱管理接口。 ImapEngine 1.22.3之前版本存在安全漏洞，该漏洞源于ImapConnection.php中的id函数对用户输入中和不当，可能导致攻击者通过包含引号字符或CRLF序列读取或删除受害者的电子邮件、终止受害者会话或在受害者邮箱上执行任何有效的IMAP命令。
CVSS Information
N/A
Vulnerability Type
N/A