CVE-2005-0313 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 3.4% (pctl 88)
Patch early
A public exploit exists.
Description
Multiple directory traversal vulnerabilities in Magic Winmail Server 4.0 Build 1112 allow remote attackers to (1) upload arbitrary files via certain parameters to upload.php or (2) read arbitrary files via certain parameters to download.php, and remote authenticated users to read, create, or delete arbitrary directories and files via the IMAP commands (3) CREATE, (4) EXAMINE, (5) SELECT, or (6) DELETE.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 3.39% — more likely to be exploited than 88% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2005-01-27 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| amax information technologies | magic winmail server |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Magic Winmail Server 4.0 (Build 1112) - 'download.php' Traversal Arbitrary File Access | 2005-01-27 |
| exploit-db | Magic Winmail Server 4.0 (Build 1112) - 'upload.php' Traversal Arbitrary File Upload | 2005-01-27 |
References
- http://marc.info/?l=bugtraq&m=110685011825461&w=2
- http://secunia.com/advisories/14053
- http://securitytracker.com/id?1013017
- http://www.securityfocus.com/bid/12388
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19108
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19114
- http://marc.info/?l=bugtraq&m=110685011825461&w=2
- http://secunia.com/advisories/14053
- http://securitytracker.com/id?1013017
- http://www.securityfocus.com/bid/12388
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19108
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19114
→ the Explorer · watch your stack · NVD