[原文]IMP 2.2 and earlier allows attackers to read and delete arbitrary files by modifying the attachment_name hidden form variable, which causes IMP to send the file to the attacker as an attachment.

[CNNVD]IMP漏洞(CNNVD-200012-103)

        IMP 2.2及其早期版本存在漏洞。攻击者通过修改attachment_name隐藏形式变量读取和删除任意文件，该漏洞导致IMP给攻击者发送作为附件的文件。