Exploitation Summary
EIP tracks 1 public exploit for CVE-2011-2165.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in Watchguard XCS <=10.0, including unauthenticated SQL injection via the 'sid' cookie, command injection via the 'id' parameter in 'mailqueue.spl', and privilege escalation via the 'FixCorruptMail' script. It includes functional PoC code for each vulnerability, including a Python script to generate password hashes for backdoor user creation.
Description
The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in Watchguard XCS <=10.0, including unauthenticated SQL injection via the 'sid' cookie, command injection via the 'id' parameter in 'mailqueue.spl', and privilege escalation via the 'FixCorruptMail' script. It includes functional PoC code for each vulnerability, including a Python script to generate password hashes for backdoor user creation.