CVE-2004-2071

Macallan Mail Solution <2.8.4.6 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-2071. PoCs published by Ziv Kamir.

AI-analyzed exploit summary The exploit describes an authentication bypass vulnerability in Macallan Mail Solution by submitting a crafted HTTP GET request to the administration page. The vendor claims administrative actions may not be possible post-bypass.

Description

Macallan Mail Solution 2.8.4.6 (Build 260), and possibly earlier versions, allows remote attackers to bypass authentication in the web interface via an HTTP GET request with two slashes ("//") after the server name.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Ziv Kamir · textwebappsphp
https://www.exploit-db.com/exploits/23687

The exploit describes an authentication bypass vulnerability in Macallan Mail Solution by submitting a crafted HTTP GET request to the administration page. The vendor claims administrative actions may not be possible post-bypass.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Theoretical
Target: Macallan Mail Solution 2.8.4.6(Build 260)
No auth needed
Prerequisites: Network access to the target web interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1009030
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/3926
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/15194
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/10861
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/9646
Third Party Advisory x_refsource_misc
https://testzone.secunia.com/advisories/10861

Scores

EPSS 0.0350
EPSS Percentile 87.7%

Details

Status published
Products (1)
macallan/mail_solution 2.8.4.6_build_260
Published Dec 31, 2004
Tracked Since Feb 18, 2026