SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abookdatabase.php.
PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL parameter to reference a URL on a remote web server that contains the code.
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
DISPUTED PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when registerglobals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable.
Cross-site scripting (XSS) vulnerability in readbody.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the (1) mailbox and (2) passedid parameters.
Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in readbody.php, (2) the $senderNamespart variable in mailboxdisplay.php, and possibly other vectors including (3) the $eventtitle variable or (4) the $eventtext variable.
Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML.
Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using readbody.php.
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.
From SquirrelMail vulnerability report:
An issue was fixed that allowed arbitrary server-side code execution when SquirrelMail was configured to use the example "mapypalias" username mapping functionality.
Credits: Niels Teusink
Updated upstream patch (2009-05-21): http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?r1=13549&r2=13733&view=patch
From SquirrelMail vulnerability report:
An issue was fixed that allowed an attacker to possibly steal user data by hijacking the SquirrelMail login session.
Credits: Tomas Hoger
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676
prefs.php in SquirrelMail before 1.4.4, with registerglobals enabled, allows remote attackers to inject local code into the SquirrelMail code via custom preference handlers.
SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, which generates an error message when the file cannot be included in the script.
Cross-site scripting (XSS) vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via certain integer variables.
optionsidentities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS) attacks, and write arbitrary files.
A, From SquirrelMail vulnerability report (http://www.squirrelmail.org/security/issue/2009-05-08):
Two issues were fixed that both allowed an attacker to run arbitrary script (XSS) on most any SquirrelMail page by getting the user to click on specially crafted SquirrelMail links.
Credits: Niels Teusink and Christian Balzer
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670
B, From SquirrelMail vulnerability report: (http://www.squirrelmail.org/security/issue/2009-05-09):
An issue was fixed wherein input to the contrib/decryptheaders.php script was not sanitized and allowed arbitrary script execution upon submission of certain values.
Credits: Niels Teusink
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672
From Squirrelmail vulnerability report:
An issue was fixed that allowed phishing and cross-site scripting (XSS) attacks to be run by surreptitious placement of content in specially-crafted emails sent to SquirrelMail users.
Credits: Luc Beurton
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13667
functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Multiple cross-site scripting (XSS) flaws were found in the SquirrelMail webmail client: XSS flaws in generic options inputs, XSS flaw in the SquirrelSpell plug-in, XSS flaw in the Index Order page.
Also protection against Cross-site Request Forgery (CSRF) flaws has been added to the empty trash feature and to the Index Order page.
The CSRF flaws got a dedicated CVE identifier of CVE-2011-2753. For further information have a look at: [1] https://bugzilla.redhat.com/showbug.cgi?id=CVE-2011-2753
Upstream advisory: [2] http://www.squirrelmail.org/security/issue/2011-07-11
Relevant upstream patch: [3] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119