CVE-2006-5313

hastymail < 1.5 - Authenticated SMTP Command Injection via smtp_message Parameter

Title source: llm
STIX 2.1

Description

Hastymail 1.5 and earlier before 20061008 allows remote authenticated users to send arbitrary SMTP commands by placing them after a CRLF.CRLF sequence in the smtp_message parameter. NOTE: this crosses privilege boundaries if the SMTP server configuration prevents a user from establishing a direct SMTP session. NOTE: this is a different type of issue than CVE-2006-5262.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/29407
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/453417/100/0/threaded
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3956
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22308
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20424

Scores

EPSS 0.0135
EPSS Percentile 68.3%

Details

CWE
CWE-20
Status published
Products (5)
hastymail/hastymail 1.0.1
hastymail/hastymail 1.0.2
hastymail/hastymail 1.1
hastymail/hastymail 1.2
hastymail/hastymail < 1.5
Published Oct 17, 2006
Tracked Since Feb 18, 2026