Command Injection in Roundcube sendmail.inc

This repository provides a working exploit for CVE-2016-9920, a remote code execution vulnerability in Roundcube Webmail versions 1.2.2 and earlier. The exploit leverages improper sanitization of user input passed to PHP's mail() function, allowing an attacker to inject arguments to sendmail and write a malicious PHP file (webshell) to the webroot. The repository includes a Dockerfile to set up a vulnerable Roundcube environment, a Python exploit script (exploit.py) that automates authentication, exploitation, and webshell interaction, and a sample Roundcube configuration file. The exploit requires valid credentials and knowledge of the webroot path. Upon successful exploitation, a webshell is deployed, granting the attacker remote command execution via HTTP. The main attack vector is network-based, targeting the webmail interface. The repository is well-structured for both demonstration and testing of the vulnerability.