Document Title: =============== ATMAIL WebMail Admin v6.3.4 - Multiple Vulnerabilities References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=376 Release Date: ============= 2012-01-07 Vulnerability Laboratory ID (VL-ID): ==================================== 376 Product & Service Introduction: =============================== Atmail is a commercial Linux messaging platform provider. The company was founded in 2001 and has its company headquarters located in Peregian Beach, Australia. The company develops webmail, mail-server and groupware solutions built for Linux and other Unix operating systems, and includes the source code under a commercial license. Atmail provides 2 different web based application which are integrated on appliances or different software types. The first service the the ATWebMail Application the second is the ATWebMail Admin Application. (Copy of the Vendor Homepage: http://en.wikipedia.org/wiki/@Mail) Abstract Advisory Information: ============================== A Vulnerability-Lab researcher discovered multiple Web Vulnerabilities on the famous ATMAIL Web Admin Application v6.3.4. Vulnerability Disclosure Timeline: ================================== 2012-11-01: Vendor Notification 2012-01-07: Public or Non-Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== ATMAIL Product: WebMail Admin 6.3.4 Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ Multiple persistent input validation vulnerabilities are detected on the ATMAIL WebMail Admin Application v6.3.4. The vulnerability allows an remote attacker to inject persistent malicious script code. Successful exploitation can results in persistent content manipulation, server-side session hijacking & module context manipulation. Vulnerable Module(s): [+] UserManagement & Listing - FirstName or LastName [+] Exception-Handling of the Application - Output [+] Mass-Mail Input & Output Listing Picture(s): ../1.1.png ../1.2.png ../2.png Proof of Concept (PoC): ======================= The vulnerabilities can be exploited by remote attacker with low required user inter action or by local low privileged user accounts. For demonstration or reproduce ... Code Review: Exception Handling of the Application Service
?????SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '">Application error

Exception information:< /h3>

Message:
 SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '">