Description
Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field, when force_default_lang is disabled, in (b) index.php, as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- NOCC Webmail 1.0 - Local File Inclusion / Remote Code Execution EDB-1522 · webapps · Feb 23, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1015671 vdb-entry
- nocc-index-file-include(24934) vdb-entry
- 23416 vdb-entry
- 20060223 NOCC Webmail <= 1.0 multiple vulnerabilities mailing-list
- 23417 vdb-entry
- 16921 third-party-advisory
- http://retrogod.altervista.org/noccw_10_incl_xpl.html
- 16793 vdb-entry
- 23418 vdb-entry
- 23419 vdb-entry