ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line argument.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Vacation_plugin | Squirrelmail | * | 0.15 (including) |