Test ID:	1.3.6.1.4.1.25623.1.0.800822
Category:	Web application abuses
Title:	V-webmail Multiple PHP Remote File Inclusion Vulnerability
Summary:	V-webmail is prone to Multiple PHP Remote File Inclusion vulnerability.
Description:	Summary: V-webmail is prone to Multiple PHP Remote File Inclusion vulnerability. Vulnerability Insight: The flaws are due to error in 'CONFIG[pear_dir]' parameter to Mail/RFC822.php, Net/Socket.php, XML/Parser.php, XML/Tree.php, Mail/mimeDecode.php, Log.php, Console/Getopt.php, System.php, and File.php in includes/pear/ directory and also in includes/cachedConfig.php, includes/mailaccess/pop3.php, and includes/prepend.php files, and error exists in 'CONFIG[includes]' parameter to prepend.php and email.list.search.php in includes/. Vulnerability Impact: Successful exploitation will let the remote attacker to execute arbitrary PHP code via a URL in the CONFIG[pear_dir] or CONFIG[includes] parameters when register_globals is enabled. Affected Software/OS: V-webmail version 1.6.4 and prior Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-6840 BugTraq ID: 30162 http://www.securityfocus.com/bid/30162 http://packetstormsecurity.org/0807-exploits/vwebmail-rfi.txt XForce ISS Database: vwebmail-configpeardir-file-include(46680) https://exchange.xforce.ibmcloud.com/vulnerabilities/46680 Common Vulnerability Exposure (CVE) ID: CVE-2006-2666 BugTraq ID: 30164 http://www.securityfocus.com/bid/30164 https://www.exploit-db.com/exploits/1827 http://securitytracker.com/id?1016160 http://secunia.com/advisories/20297 http://www.vupen.com/english/advisories/2006/1989 XForce ISS Database: vwebmail-pop3-file-include(26694) https://exchange.xforce.ibmcloud.com/vulnerabilities/26694
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.