Exploitation Summary
CVE-2005-4558 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Tan Chew Keong.
AI-analyzed exploit summary The provided text describes an input-validation vulnerability in IceWarp Universal WebMail, which can lead to arbitrary file inclusion and execution of malicious PHP code. It also mentions that the issue affects Merak Mail Server and VisNetic MailServer.
Description
IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include arbitrary PHP code via a URL in a modified lang_settings parameter to mail/index.html.
Exploits (2)
The provided text describes an input-validation vulnerability in IceWarp Universal WebMail, which can lead to arbitrary file inclusion and execution of malicious PHP code. It also mentions that the issue affects Merak Mail Server and VisNetic MailServer.
This exploit demonstrates a file inclusion vulnerability in IceWarp Universal WebMail, allowing an attacker to include arbitrary local or remote files containing malicious PHP code. The vulnerability is triggered via the 'lang_settings' parameter in the URL.