SquirrelMail 1.4.11 and 1.4.12, as distributed on sourceforge.net before 20071213, has been externally modified to create a Trojan Horse that introduces a PHP remote file inclusion vulnerability, which allows remote attackers to execute arbitrary code.
Vulnerability category: File inclusionExecute code
Exploit prediction scoring system (EPSS) score for CVE-2007-6348
Probability of exploitation activity in the next 30 days: 9.42%
CVSS scores for CVE-2007-6348
CWE ids for CVE-2007-6348
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: email@example.com (Primary)
Vendor statements for CVE-2007-6348
Red Hat 2007-12-17The versions of SquirrelMail packages shipped in Red Hat Enterprise Linux 3, 4, and 5 were not affected by this issue. In addition, the Red Hat Security Response Team have verified that the malicious code is not part of released Red Hat Enterprise Linux squirrelmail packages.