Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-5210. PoCs published by Derek Callaway.
AI-analyzed exploit summary This exploit leverages a directory traversal vulnerability in IronWebMail to retrieve arbitrary files by manipulating the IM_FILE parameter with URL-encoded dot-dot-slash sequences. The PoC demonstrates unauthenticated access to sensitive files like admin.xml.
Description
Directory traversal vulnerability in IronWebMail before 6.1.1 HotFix-17 allows remote attackers to read arbitrary files via a GET request to the IM_FILE identifier with double-url-encoded "../" sequences ("%252e%252e/").
Exploits (1)
This exploit leverages a directory traversal vulnerability in IronWebMail to retrieve arbitrary files by manipulating the IM_FILE parameter with URL-encoded dot-dot-slash sequences. The PoC demonstrates unauthenticated access to sensitive files like admin.xml.