CVE-2006-5262

EPSS 2.5%

CRLF injection vulnerability in lib/session.php in Hastymail 1.5 and earlier before 20061008 allows remote authenticated users to send arbitrary IMAP commands via a CRLF sequence in a mailbox name. NOTE: the attack crosses privilege boundaries if the IMAP server configuration prevents a user from establishing a direct IMAP session.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/28777unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://hastymail.sourceforge.net/security.php http://secunia.com/advisories/22308 https://exchange.xforce.ibmcloud.com/vulnerabilities/29407 http://www.securityfocus.com/archive/1/453417/100/0/threaded http://www.securityfocus.com/bid/20424 http://www.vupen.com/english/advisories/2006/3956