CVE-2005-4557

published 2005-12-28

CVE-2005-4557: dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remote attackers to…

Priority P2 68 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

ITW EXPLOIT VulnCheck KEV

dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remote attackers to include arbitrary local files via a null byte (%00) in the lang parameter, possibly due to a directory traversal vulnerability.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
deerfield	visnetic_mail_server	—	—
icewarp	web_mail	—	—
merak	mail_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://example.com:32000/dir/include.html?lang=[file]%00↗

path /dir/include.html↗

port 32000↗

• → Detect LFI attempts targeting /dir/include.html via null byte (%00) injection in the 'lang' query parameter ↗
• → Monitor HTTP requests to /dir/include.html containing '%00' in the lang parameter value, indicative of null-byte directory traversal exploitation ↗
• → This vulnerability was confirmed actively exploited in the wild as of July 30, 2007; prioritize detection on exposed IceWarp WebMail, Merak Mail Server 8.3.0r, and VisNetic MailServer 8.3.0 build 1 instances ↗

• · The null byte (%00) technique truncates the file path at the OS level; detection must decode URL-encoded null bytes in the lang parameter before matching ↗
• · The exploit may also facilitate remote file inclusion (arbitrary local OR remote files with malicious PHP code); detection rules should cover both local path traversal and remote URL patterns in the lang parameter ↗

CVSS provenance

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

vulncheck 5.0 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.