Vulnerabilities > CVE-2004-1129 - Remote vulnerability in Youngzsoft Cmailserver 5.2.0

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
youngzsoft
critical
nessus
NVD
Published: 2005-01-10
Updated: 2017-07-11

Summary

SQL injection vulnerability in (1) fdelmail.asp, (2) addressc.asp, and possibly (3) postmail.asp and (4) fmvmail.asp in CMailServer 5.2 allow remote attackers to inject arbitrary SQL commands and delete mail metadata or e-mail addresses of contacts via the indexOfMail parameter.

Vulnerable Configurations

Part Description Count
Application
Youngzsoft
1

Nessus

NASL familySMTP problems
NASL idCMAIL_MULTIPLE.NASL
descriptionThe remote host is running YoungZSoft CMailServer, a mail server for Microsoft Windows. The version of CMailServer running on the remote machine has multiple vulnerabilities, including buffer overflow, SQL injection, and HTML injection. These vulnerabilities could allow a remote attacker to execute arbitrary code.
last seen2020-06-01
modified2020-06-02
plugin id15828
published2004-11-24
reporterThis script is Copyright (C) 2004-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/15828
titleYoungzsoft CMailServer < 5.2.1 Multiple Remote Vulnerabilities
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if(description)
{
 script_id(15828);
 script_cve_id("CVE-2004-1128", "CVE-2004-1129", "CVE-2004-1130");
 script_bugtraq_id(11742);
 script_xref(name:"Secunia", value:"13298");

 script_version ("1.17");
 script_name(english:"Youngzsoft CMailServer < 5.2.1 Multiple Remote Vulnerabilities");
 script_summary(english:"Detects the version of CMail");
 
 script_set_attribute(
   attribute:"synopsis",
   value:"The remote mail server has multiple vulnerabilities."
 );
 script_set_attribute(attribute:"description", value:
"The remote host is running YoungZSoft CMailServer, a mail server
for Microsoft Windows.

The version of CMailServer running on the remote machine has multiple
vulnerabilities, including buffer overflow, SQL injection, and HTML
injection.  These vulnerabilities could allow a remote attacker to
execute arbitrary code." );
 script_set_attribute(
   attribute:"see_also",
   value:"https://seclists.org/bugtraq/2004/Nov/335"
 );
 script_set_attribute(
   attribute:"solution", 
   value:"Upgrade to CMailServer 5.2.1 or later."
 );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"false");
 script_set_attribute(attribute:"plugin_publication_date", value: "2004/11/24");
 script_set_attribute(attribute:"vuln_publication_date", value: "2004/11/24");
 script_cvs_date("Date: 2018/11/15 20:50:24");
 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_end_attributes();
 
 script_category(ACT_GATHER_INFO);
 script_family(english:"SMTP problems");
 
 script_copyright(english:"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.");
 
 script_dependencie("find_service2.nasl");
 script_require_ports("Services/cmailserver-smtp");
 exit(0);
}

#
# The script code starts here
#
include("smtp_func.inc");
port = get_kb_item("Services/cmailserver-smtp");
if ( ! port ) exit(0);
banner = get_smtp_banner ( port:port);
if ( egrep(pattern:"^220 ESMTP CMailServer ([0-4]\..*|5\.([0-1]\..*|2\.0.*))SMTP Service Ready", string:banner) )
{
	security_hole ( port );
	set_kb_item(name: 'www/'+port+'/SQLInjection', value: TRUE);
}

References