CVE-2005-0313
Magic Winmail Server 4.0 Build 1112 - Directory Traversal and Arbitrary File Upload via upload.php and download.php
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-0313. PoCs published by Tan Chew Keong.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in Magic Winmail Server's Webmail interface, allowing arbitrary file uploads. The PoC uploads a PHP file with a reverse shell payload to a traversed directory path.
Description
Multiple directory traversal vulnerabilities in Magic Winmail Server 4.0 Build 1112 allow remote attackers to (1) upload arbitrary files via certain parameters to upload.php or (2) read arbitrary files via certain parameters to download.php, and remote authenticated users to read, create, or delete arbitrary directories and files via the IMAP commands (3) CREATE, (4) EXAMINE, (5) SELECT, or (6) DELETE.
Exploits (2)
This exploit demonstrates a directory traversal vulnerability in Magic Winmail Server's Webmail interface, allowing arbitrary file uploads. The PoC uploads a PHP file with a reverse shell payload to a traversed directory path.
This exploit demonstrates directory traversal vulnerabilities in Magic Winmail Server's Webmail interface, allowing arbitrary file downloads via crafted URLs. The PoC includes base64-encoded and plaintext traversal sequences to access sensitive files like 'userauth.cfg'.