Description
The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell metacharacters such as "`" (backticks) in the password.
References
- 10274 vdb-entry
- 20040504 remote root exec vulnerability in omail mailing-list
- 9585 third-party-advisory
- omailwebmail-checklogin-code-execution(12948) vdb-entry