Open WebMail userstat.pl Arbitrary Command Execution

Summary
The target is running at least one instance of Open WebMail in which the userstat.pl component fails to sufficiently validate user input. This failure enables remote attackers to execute arbitrary programs on the target using the privileges under which the web server operates. For further information, see : http://www.openwebmail.org/openwebmail/download/cert/advisories/SA-04:01.txt
Solution
Upgrade to Open WebMail version 2.30 20040127 or later.