Dodosmail "dodosmail_header_file" And "dodosmail_footer

[TCH-Thomas]

Secunia reports this as Highly critical.

Read more at: http://secunia.com/advisories/22775/

 

Description:

CoLd Zero has discovered two vulnerabilities in DodosMail, which can be exploited by malicious people to disclose sensitive information and potentially compromise a vulnerable system.

 

Input passed to the "dodosmail_header_file" and "dodosmail_footer_file" parameters in dodosmail.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources and potentially also from external resources.

 

The vulnerabilities are confirmed in version 2.1. Other versions may also be affected.

 

Solution:

Edit the source code to ensure that input is properly verified.

[TCH-Bruce]

Thanks Thomas

[abinidi]

Thanks Thomas.

 

Any help out there on making the input "properly verified"? (whatever that means)

 

I wish I could find a good, secure, free form script. Emphasis on free. Double-emphasis on secure.