CVEvulnerability
CVE-2020-11804
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-09-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
An issue was discovered in Titan SpamTitan 7.07. Due to improper sanitization of the parameter quid, used in the page mailqueue.php, code injection can occur. The input for this parameter is provided directly by an authenticated user via an HTTP GET request.
Affected configurations
• titanhq spamtitan 7.07
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://packetstormsecurity.com/files/159218/SpamTitan-7.07-Remote-Code-Execution.html Exploit, Third Party Advisory
- https://github.com/felmoltor Third Party Advisory
- https://sensepost.com/blog/2020/clash-of-the-spamtitan/ Exploit, Third Party Advisory
- https://twitter.com/felmoltor Third Party Advisory
- https://www.spamtitan.com Vendor Advisory
- http://packetstormsecurity.com/files/159218/SpamTitan-7.07-Remote-Code-Execution.html Exploit, Third Party Advisory
- https://github.com/felmoltor Third Party Advisory
- https://sensepost.com/blog/2020/clash-of-the-spamtitan/ Exploit, Third Party Advisory
- https://twitter.com/felmoltor Third Party Advisory
- https://www.spamtitan.com Vendor Advisory