CVE-2020-11804

HIGH

SpamTitan 7.07 - Authenticated Code Injection via mailqueue.php quid Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-11804. PoCs published by Felipe Molina.

AI-analyzed exploit summary This is a functional exploit for multiple authenticated RCE vulnerabilities in SpamTitan Gateway 7.07, leveraging command injection and PHP eval abuse to achieve remote code execution. It includes reverse shell functionality and arbitrary file read capabilities.

Description

An issue was discovered in Titan SpamTitan 7.07. Due to improper sanitization of the parameter quid, used in the page mailqueue.php, code injection can occur. The input for this parameter is provided directly by an authenticated user via an HTTP GET request.

Exploits (1)

exploitdb WORKING POC
by Felipe Molina · pythonwebappsmultiple
https://www.exploit-db.com/exploits/48817

This is a functional exploit for multiple authenticated RCE vulnerabilities in SpamTitan Gateway 7.07, leveraging command injection and PHP eval abuse to achieve remote code execution. It includes reverse shell functionality and arbitrary file read capabilities.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: SpamTitan Gateway 7.07
Auth required
Prerequisites: Authenticated access to the SpamTitan web interface · Network connectivity to the target · Python 3 with requests library
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory x_refsource_misc
https://github.com/felmoltor
Third Party Advisory x_refsource_misc
https://twitter.com/felmoltor
Vendor Advisory x_refsource_misc
https://www.spamtitan.com
Exploit, Third Party Advisory x_refsource_misc
https://sensepost.com/blog/2020/clash-of-the-spamtitan/

Scores

CVSS v3 8.8
EPSS 0.0711
EPSS Percentile 93.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (1)
titanhq/spamtitan 7.07
Published Sep 17, 2020
Tracked Since Feb 18, 2026