CVE-2020-11804

An issue was discovered in Titan SpamTitan 7.07. Due to improper sanitization of the parameter quid, used in the page mailqueue.php, code injection can occur. The input for this parameter is provided directly by an authenticated user via an HTTP GET request.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

7.11% chance of exploitation in the next 30 days, 94th percentile

Published

2020-09-17

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/159218/SpamTitan-7.07-Remote-Code-Execution.html
• https://sensepost.com/blog/2020/clash-of-the-spamtitan/

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/48817

References

• CVE Record
• NVD entry

Related

• CVE-2020-11803
• CVE-2020-11819
• CVE-2020-11800
• CVE-2020-11851
• CVE-2020-11798
• CVE-2020-11853