Unscored CVE-2000-0877 EUVD-2000-0864GHSA-w24q-78r2-qqx9

mailform.pl CGI script in MailForm 2.0 allows remote attackers to read arbitrary files by specifying the file name in the XX-attach_file pa…

Published Sep 18, 2001 · Updated Aug 8, 2024 · Assigned by mitre

Description

mailform.pl CGI script in MailForm 2.0 allows remote attackers to read arbitrary files by specifying the file name in the XX-attach_file parameter, which MailForm then sends to the attacker.

References

1670 vdb-entry
mailform-attach-file(5224) vdb-entry
20000911 Unsafe passing of variables to mailform.pl in MailForm V2.0 mailing-list