CVE-2005-4558

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-28 · updated 2026-06-16

Description

IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include arbitrary PHP code via a URL in a modified lang_settings parameter to mail/index.html.

Affected products

Deerfield Visnetic Mail Server: 8.3.0_build1
IceWarp Web Mail: 5.5.1
Merak Mail Server: 8.3.0r

References

http://marc.info/?l=full-disclosure&m=113570229524828&w=2
http://secunia.com/advisories/17046
http://secunia.com/advisories/17865
http://secunia.com/secunia_research/2005-62/advisory/
http://securitytracker.com/id?1015412
http://www.osvdb.org/22080
http://www.osvdb.org/22081
http://www.securityfocus.com/archive/1/420255/100/0/threaded
http://www.securityfocus.com/bid/16069
https://exchange.xforce.ibmcloud.com/vulnerabilities/23904
http://marc.info/?l=full-disclosure&m=113570229524828&w=2
http://secunia.com/advisories/17046

Get alerted when CVE-2005-4558 or the next vulnerability affects your stack