Description
Mailcow存在OS命令注入漏洞，此漏洞是由于对发送给syncjob接口的请求验证不当造成的。
Mailcow syncjob 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.nsfocus.net/vulndb/67411
https://app.opencve.io/cve/?product=mailcow&vendor=mailcow
https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3j2f-wf52-cjg7
https://dbugs.ptsecurity.com/vulnerability/PT-2022-20557
https://access.redhat.com/security/cve/cve-2023-26490
https://cve.imfht.com/vendor/mailcow
https://avd.aliyun.com/detail?id=AVD-2022-31138
https://cn.t00ls.com/articles-71900.html
https://www.sonarsource.com/blog/remote-code-execution-in-mailcow-always-sanitize-error-messages