CVE-2018-20323: MailCleaner Community Edition Logs.php OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote OS command injection with public exploit code and very high EPSS, though it requires low privileges and is not in KEV.

What it is

MailCleaner Community Edition 2018.08 contains an OS command injection flaw in www/soap/application/MCSoap/Logs.php. A remote attacker can inject commands that execute on the underlying host, compromising the mail gateway. The record does not list affected versions beyond 2018.08.

Impact

An attacker gains arbitrary OS command execution on the MailCleaner server, leading to full compromise of confidentiality, integrity and availability. This can expose mail data and credentials and allow the host to be used as a pivot.

Attack surface

Reachable over the network through the SOAP interface at www/soap/application/MCSoap/Logs.php. The CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N).

Exploitation

Public exploit code is referenced by Packet Storm and pentest.blog, and EPSS is 0.54498 (98.9th percentile), indicating high likelihood of exploitation. It is not listed in CISA KEV.

What to do

• Apply the vendor fix for MailCleaner Community Edition 2018.08 or later; if no patch is available, upgrade to a supported release.
• Restrict network access to the SOAP interface and administrative endpoints to trusted management networks only.
• Enforce least privilege for accounts that can reach the SOAP service and remove unused accounts.
• Monitor and block exploit attempts targeting Logs.php at the web application firewall or reverse proxy.
• Isolate the MailCleaner host from other internal systems to limit lateral movement if compromised.

Detection

• Inspect web server and SOAP access logs for requests to /soap/application/MCSoap/Logs.php with shell metacharacters or unusual parameters.
• Monitor for unexpected child processes spawned by the web server or PHP process, especially shell interpreters.
• Alert on outbound network connections from the MailCleaner host to unknown destinations.
• Review file integrity and command history on the MailCleaner host for signs of injected commands.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.