compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php.
DISPUTED compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendor disputes this because these two conditions for PHP object injection are not satisfied: existence of a PHP magic method (such as wakeup or destruct), and any attack-relevant classes must be declared before unserialize is called (or must be autoloaded). .
Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords.
mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandled after $encoded has been set to true.
From SquirrelMail vulnerability report:
An issue was fixed that allowed arbitrary server-side code execution when SquirrelMail was configured to use the example "mapypalias" username mapping functionality.
Credits: Niels Teusink
Updated upstream patch (2009-05-21): http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?r1=13549&r2=13733&view=patch
It was discovered that original upstream patch for server-side command execution flaw affecting setups with mapypalias username map enabled did not address the issue completely, due to incorrect use of quoting (backticks vs. single quotes). Code execution was still possible in upstream version 1.4.18.
Issue was fixed upstream in 1.4.19.
Updated upstream security advisory: http://www.squirrelmail.org/security/issue/2009-05-10
Full upstream patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?r1=13549&r2=13733
It was reported that SquirrelMail did not implement protections against cross-site request forgery (CSRF) attacks. This can be exploited to e.g. change user preferences, delete emails, and potentially send emails when a logged-in user visits a malicious web page.
Upstream advisory: http://www.squirrelmail.org/security/issue/2009-08-12
Upstream patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
Issue was first addressed in 1.4.20RC1.
Secunia advisory: http://secunia.com/advisories/34627/
It was discovered that original upstream patch for server-side command execution flaw affecting setups with mapypalias username map enabled did not address the issue completely, due to incorrect use of quoting (backticks vs. single quotes). Code execution was still possible in upstream version 1.4.18.
Issue was fixed upstream in 1.4.19.
Updated upstream security advisory: http://www.squirrelmail.org/security/issue/2009-05-10
Full upstream patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?r1=13549&r2=13733
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka optionsorder) page, a different issue than CVE-2010-4555.
The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.
XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack.
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack.
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack.
The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.
The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).
CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability than CVE-2010-4555.
A Red Hat Security Advisory RHSA-2012:0103 for squirrelmail packages shipped in Red Hat Enterprise Linux 4 and 5 claim to have fixed CVE-2010-2813 issue ("CVE-2010-2813 SquirrelMail: DoS (disk space consumption) by random IMAP login attempts with 8-bit characters in the password", bug #618096). However, the patch for this issue was not applied correctly and hence the issue was not fixed as stated in the advisory.
Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Reference: BUGTRAQ:20080922 Squirrelmail: Session hijacking vulnerability, CVE-2008-3663 Reference: URL:http://www.securityfocus.com/archive/1/archive/1/496601/100/0/threaded Reference: MISC:http://int21.de/cve/CVE-2008-3663-squirrelmail.html Reference: BID:31321 Reference: URL:http://www.securityfocus.com/bid/31321
Cross-site scripting (XSS) vulnerability in the Autocomplete plugin before 3.0 for SquirrelMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
An cross-site scripting (XSS) flaw was found in the way SquirrelMail performed sanitization of MIME messages containing certain <style> HTML tags. A remote attacker could provide a specially-crafted message, which once opened in SquirrelMail webmail client could lead to arbitrary JavaScript or HTML code execution.
Upstream advisory: [1] http://www.squirrelmail.org/security/issue/2011-07-10
Relevant patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14121
Cross-site scripting (XSS) vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an e-mail message.
Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Reference: BUGTRAQ:20080922 Squirrelmail: Session hijacking vulnerability, CVE-2008-3663 Reference: URL:http://www.securityfocus.com/archive/1/archive/1/496601/100/0/threaded Reference: MISC:http://int21.de/cve/CVE-2008-3663-squirrelmail.html Reference: BID:31321 Reference: URL:http://www.securityfocus.com/bid/31321
It was reported that SquirrelMail did not implement protections against cross-site request forgery (CSRF) attacks. This can be exploited to e.g. change user preferences, delete emails, and potentially send emails when a logged-in user visits a malicious web page.
Upstream advisory: http://www.squirrelmail.org/security/issue/2009-08-12
Upstream patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
Issue was first addressed in 1.4.20RC1.
Secunia advisory: http://secunia.com/advisories/34627/
An cross-site scripting (XSS) flaw was found in the way SquirrelMail performed sanitization of MIME messages containing certain <style> HTML tags. A remote attacker could provide a specially-crafted message, which once opened in SquirrelMail webmail client could lead to arbitrary JavaScript or HTML code execution.
Upstream advisory: [1] http://www.squirrelmail.org/security/issue/2011-07-10
Relevant patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14121