full-disclosure - confixx e-mail bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200410241728.12259.bugtraq@int80h.de>
From: bugtraq at int80h.de (Igor Buchmueller)
Subject: confixx e-mail bug

Hello,

I noticed a bug in confixx. Confixx is a software to administrate websites. 
nice feautures are to create costumers or reseller costumers and gain them 
tools to administrate theirself websites.

It is possible to catch all e-mails as a normal user which are going from the 
server to domain foo.bar

1. Create a costumer in your confixx. This can be done without root 
permissions on the server, you will just need a reseller account. In the 
process of creating a normal costumer, you will need to assign him/her a 
domain.

2. Assign, yahoo.com, hotmail.com or gmx.de to your costumer.

3. Login into your costumers account in confixx and create a wildcard e-mail 
adress for your domain.

Now, all e-mails will be deliverd to your costumers account, from this confixx 
server.

This worked for me, any comments?

with best regards, Igor

-- 
mfG, Igor B.