chudyPB

4 exploits Active since Apr 2021
CVE-2021-27180 NOMISEC MEDIUM WRITEUP
MDaemon < 20.0.4 - Reflected Cross-Site Scripting in Webmail via GET Request
An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user.
2 stars
CVSS 6.1
CVE-2021-27181 WRITEUP HIGH WRITEUP
MDaemon < 20.0.4 - Cross-Site Request Forgery via Anti-CSRF Token Fixation
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user.
CVSS 8.8
CVE-2021-27182 WRITEUP HIGH WRITEUP
MDaemon < 20.0.4 - IFRAME Injection in Webmail via Email Message
An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.
CVSS 8.8
CVE-2021-27183 WRITEUP HIGH WRITEUP
MDaemon < 20.0.4 - Authenticated Arbitrary File Write via Remote Administration
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution.
CVSS 7.2