CVE-2006-4081
Barracuda Spam Firewall (BSF) <3.3.03.053 - Command Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-4081. PoCs published by PATz, Greg Sinclair.
AI-analyzed exploit summary This exploit leverages a path traversal vulnerability in Barracuda Spam Firewall to disclose arbitrary files and execute system commands via the `preview_email.cgi` script. The PoC demonstrates command injection and file disclosure without authentication.
Description
preview_email.cgi in Barracuda Spam Firewall (BSF) 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters ("|" pipe symbol) in the file parameter. NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000.
Exploits (2)
This exploit leverages a path traversal vulnerability in Barracuda Spam Firewall to disclose arbitrary files and execute system commands via the `preview_email.cgi` script. The PoC demonstrates command injection and file disclosure without authentication.
This exploit demonstrates arbitrary file disclosure and command execution in Barracuda Spam Firewall via improper parameter sanitation in the preview_email.cgi script. It leverages directory traversal to access sensitive files and execute commands.