CVE-2008-6922
Youngzsoft Cmailserver - Memory Corruption
Title source: ruleDescription
Multiple stack-based buffer overflows in CMailCOM.dll in CMailServer 5.4.6 allow remote attackers to execute arbitrary code via a long argument to the (1) CreateUserPath, (2) Logout, (3) DeleteMailByUID, (4) MoveToInbox, (5) MoveToFolder, (6) DeleteMailEx, (7) GetMailDataEx, (8) SetReplySign, (9) SetForwardSign, and (10) SetReadSign methods, which are not properly handled by (a) the POP3 Class ActiveX control (CMailCom.POP3); or a long argument to the (11) AddAttach, (12) SetSubject, (13) SetBcc, (14) SetBody, (15) SetCc, (16) SetFrom, (17) SetTo, and (18) SetFromUID methods, which are not properly handled by the Class ActiveX control (CMailCOM.SMTP), as demonstrated via the indexOfMail parameter to mwmail.asp.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Nine:Situations:Group · phpremotewindows
https://www.exploit-db.com/exploits/6012
References (5)
Scores
EPSS
0.0802
EPSS Percentile
92.1%
Details
CWE
CWE-119
Status
published
Products (1)
youngzsoft/cmailserver
5.4.6
Published
Aug 10, 2009
Tracked Since
Feb 18, 2026