IMAP Injection Supposedly, if the link:

http://<webmail-addr>/show_email.php?m_id=8

would display the eighth message in the current folder, then simply replacing the number in the URL would result in displaying the message with the corresponding number. This is the intended behavior of the application. The actual command to retrieve the eighth message that would be set to the server would be:

FETCH 8 BODY[HEADER]

It is very clear what the variable replaces. If we change the variable itself we get:

FETCH + <variable> + BODY[HEADER]

To perform a code injection into the mail server, such as two fetch operations instead of one, we would need to run these commands on the mail server IMAP service:

FETCH 8 BODY[HEADER]
? FETCH 7 BODY[HEADER]

Starting from the same basic replacement pattern above, we can conclude that the URL required to access two e-mails at once is:

http://<webmail-addr>/show_email.php?m_id=8 BODY[HEADER]%0d%0a? FETCH 7

This particular example makes use of a very handy string inside the actual URL. "%0d%0a" is the newline character (CRLF - carriage-return and line-feed). This character is always required while issuing multiple line commands. In truth, code injection is very rarely used without spanning the code injected over multiple lines.