This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: SuperWebMailer suffers from a **Code Injection** flaw. π **Consequences**: Attackers can execute **arbitrary PHP code** remotely. This leads to full server compromise, data theft, or botnet recruitment.
Q2Root Cause? (CWE/Flaw)
π οΈ **Root Cause**: **Input Validation Failure**. The `Language` parameter in `mailingupgrade.php` is not sanitized. π₯ **Flaw**: Direct injection of malicious code into the PHP execution context.
Q3Who is affected? (Versions/Components)
π― **Affected**: **SuperWebMailer**. π¦ **Version**: Specifically **7.21.0.01526**. β οΈ **Component**: The `mailingupgrade.php` file handling language selection.
Q4What can hackers do? (Privileges/Data)
π **Capabilities**: **Remote Code Execution (RCE)**. ποΈ **Privileges**: Attacker gains the same privileges as the web server process. π **Data**: Can read/write files, dump databases, or install backdoors.
Q5Is exploitation threshold high? (Auth/Config)
π **Threshold**: **LOW**. π« **Auth**: **Unauthenticated**. No login required to trigger the vulnerability. π **Config**: Direct HTTP request to the specific PHP file is sufficient.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exp**: **YES**. π **Python**: Available via `CVE-2020-11546.py`. π **Go**: Available via `github.com/damit5/CVE-2020-11546`. π‘ **Nuclei**: Template exists for automated scanning.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for `mailingupgrade.php` with malicious `Language` payloads. π‘ **Tools**: Use **Nuclei** templates or the provided Python/Go scripts. π **Indicator**: Look for successful PHP execution responses.
Q8Is it fixed officially? (Patch/Mitigation)
π‘οΈ **Fix**: **Update** to a patched version immediately. π **Note**: Specific fixed version number is not listed in the data, but upgrading is the primary mitigation.β¦
π§ **Workaround**: **Block Access** to `mailingupgrade.php` via WAF or Web Server config. π« **Restrict**: Deny external access to this specific endpoint if possible.β¦
β‘ **Urgency**: **CRITICAL**. π¨ **Priority**: **P1**. Unauthenticated RCE is a high-severity threat. π **Action**: Patch or mitigate **immediately**. Do not wait.