cPanel 5/6 / Formail-Clone - E-Mail Restriction Bypass

Author: Chad C. Keep
type: webapps
platform: php
port: 
date_added: 2003-05-30 
date_updated: 2012-11-14 
verified: 1 
codes: OSVDB-4222 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/7758/info

It has been reported that cPanel is prone to an issue where a remote attacker may bypass cPanel Formail-clone local domain checks and have untrusted e-mail delivered in the context of the vulnerable host.

This issue may be exploited by an attacker to use the vulnerable host as an open relay.

<input type="hidden" name="recipient"
value="user1@offsitedomain.(localdomain)co
m, user2@offsitedomain.(localdomain)com">