Summary
PineApp Mail-SeCure is prone to a remote command-injection vulnerability.
Impact
Successful exploits will result in the execution of arbitrary commands with root privileges in the context of the affected appliance.
Impact Level: Application
Solution
Ask the Vendor for an update.
Insight
The specific flaw exists with input sanitization in the ldapsyncnow.php component. This flaw allows for the injection of arbitrary commands to the Mail-SeCure server. An attacker could leverage this vulnerability to execute arbitrary code as root.
Detection
Send a crafted HTTP GET request and check the response.
References
Updated on 2015-03-25
