Atmail WebAdmin and Webmail Control Panel SQL Root Password Disclosure

2012-07-23 10:05:07

######################################################################################
# Vuln Title: Atmail WebAdmin and webmail Control Panel Remote Access SQL Root password Vulnerability
#
# Author: FaryadR (a.k.a Ciph3r)
# tested on : Atmail Email Server 6.20.8
# Twitter : https://twitter.com/faryadR
# Mail : [email protected]
# Website : http://0c0c0c0c.com
# Vendor : http://atmail.com
# Powered by Atmail 6.20.8 - WebAdmin Control Panel
#
######################################################################################

[+]Vulnerability :

you can Access All Atmail Webadmin Mail server Configuration and SQL Root Password


[+]Poc :

Go to webmail and config Directory and type dbconfig.ini for Access all SQL Configuration

[+]Demo for Test Vuln :

[+]Atmail 6.20.8

http://server/config/dbconfig.ini

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.