CVE-2005-4556 in Mail Server
Summary
by MITRE
PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when register_globals is enabled, allows remote attackers to include arbitrary local and remote PHP files via a URL in the (1) lang_settings and (2) language parameters in (a) accounts/inc/include.php and (b) admin/inc/include.php.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2025
This vulnerability represents a critical remote file inclusion flaw in IceWarp Web Mail version 5.5.1 that was widely distributed through Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1. The vulnerability stems from improper input validation in the language parameter handling within the web application's include mechanisms. When the register_globals PHP configuration directive is enabled, the application fails to properly sanitize user-supplied URL parameters, creating an exploitable condition where remote attackers can inject arbitrary file paths into the include.php scripts. The vulnerability specifically affects the lang_settings and language parameters within accounts/inc/include.php and admin/inc/include.php files, which are critical administrative and user interface components of the mail server software.
The technical exploitation of this vulnerability leverages the PHP register_globals feature, which automatically creates global variables from GET, POST, and cookie data. This configuration allows attackers to manipulate the application's behavior by injecting malicious URLs through the vulnerable parameters. When the application processes these parameters, it directly includes the specified files without proper validation, enabling attackers to execute arbitrary PHP code on the target server. The vulnerability is classified under CWE-98 as "Improper Control of Generation of Code ('Code Injection')" and specifically relates to CWE-88 as "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')". The attack vector follows ATT&CK technique T1190 "Exploit Public-Facing Application" and T1105 "Ingress Tool Transfer" for initial compromise and payload delivery.
The operational impact of this vulnerability is severe as it provides attackers with potential full system compromise capabilities. Successful exploitation allows remote code execution, which can lead to complete server takeover, data exfiltration, and persistence mechanisms. Attackers can include malicious PHP scripts from remote servers, enabling them to establish backdoors, perform reconnaissance, or launch further attacks against the internal network. The vulnerability affects organizations using these specific versions of mail server software, particularly those with insecure PHP configurations where register_globals remains enabled. The attack requires minimal privileges and can be executed through standard web browser interactions, making it highly dangerous for organizations with exposed mail server interfaces. Organizations may experience unauthorized access to email accounts, modification of email content, and potential data breaches. The vulnerability also impacts the availability of the mail services as attackers can potentially cause service disruption through malicious code execution. Mitigation strategies include disabling register_globals in PHP configurations, implementing proper input validation and sanitization, applying vendor patches, and restricting direct internet access to mail server administrative interfaces. Network segmentation and monitoring for suspicious file inclusion patterns should also be implemented to detect potential exploitation attempts.