This writeup describes command injection vulnerabilities in MundiMail due to unsafe use of `system()` and `exec()` functions without proper input sanitization. It provides exploitation examples and basic mitigation steps.
Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target:MundiMail (version unspecified)
No auth needed
Prerequisites:Network access to the vulnerable endpoint · PHP execution environment