CVE-2005-4556

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when register_globals is enabled, allows remote attackers to include arbitrary local and remote PHP files via a URL in the (1) lang_settings and (2) language parameters in (a) accounts/inc/include.php and (b) admin/inc/include.php.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=full-disclosure&m=113570229524828&w=2
http://secunia.com/advisories/17046Exploit, Patch, Vendor Advisory
http://secunia.com/advisories/17865
http://secunia.com/secunia_research/2005-62/advisory/Exploit, Vendor Advisory
http://securitytracker.com/id?1015412
http://www.osvdb.org/22077
http://www.osvdb.org/22078
http://www.securityfocus.com/archive/1/420255/100/0/threaded
http://www.securityfocus.com/bid/16069Exploit
http://marc.info/?l=full-disclosure&m=113570229524828&w=2
http://secunia.com/advisories/17046Exploit, Patch, Vendor Advisory
http://secunia.com/advisories/17865
http://secunia.com/secunia_research/2005-62/advisory/Exploit, Vendor Advisory
http://securitytracker.com/id?1015412
http://www.osvdb.org/22077
http://www.osvdb.org/22078
http://www.securityfocus.com/archive/1/420255/100/0/threaded
http://www.securityfocus.com/bid/16069Exploit

Timeline

Published: Dec 28, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-45575.0dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remot CVE-2005-45586.5IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict accep CVE-2005-45595.0mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not pr CVE-2005-45607.5The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Wind CVE-2005-45637.5SQL injection vulnerability in main.php in Enterprise Heart Enterprise Connector 1.0.2 allows remote attackers to execute arbitrary SQL comm CVE-2005-45645.0The Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attackers to cause a deni CVE-2005-456510.0Format string vulnerability in the Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow r CVE-2005-456610.0Buffer overflow in the Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attack CVE-2005-45675.8Multiple cross-site scripting (XSS) vulnerabilities in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (Build 4.4.000 Oct 26 200 CVE-2005-45687.5Multiple format string vulnerabilities in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (aka Build 4.4.000 Oct 26 2005) allow CVE-2005-45697.5Stack-based buffer overflow in index.fts in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (aka Build 4.4.000 Oct 26 2005) allo CVE-2005-45707.8The Internet Key Exchange version 1 (IKEv1) implementations in Fortinet FortiOS 2.50, 2.80 and 3.0, FortiClient 2.0,; and FortiManager 2.80