Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts access to the /etc/ directory, which allows remote malicious users to read arbitrary files via the reply_message_attach attachment parameter.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
matt wright formhandler.cgi 3.0 |
||
matt wright formhandler.cgi 2.0 |
||
matt wright formhandler.cgi 1.0 |