CVE:CVE-2013-6172
CNNVD:CNNVD-201310-690
RoundCube Webmail是一款基于浏览器的IMAP客户端（邮件客户端），它支持地址薄管理、信息搜索、拼写检查等。
Roundcube Webmail 0.8.7之前的版本和0.9.5之前的0.9.x版本中的steps/utils/save_pref.inc文件中存在安全漏洞。远程攻击者可借助‘_session’参数利用该漏洞修改配置信息，也可能读取任意文件，实施SQL注入攻击，执行任意代码。
solution:Upgrade roundcube webmail to a higher version than 0.8.6,0.1,0.1:20050811,0.1:20050820,0.1:20051007,0.1:20051021,0.1:alpha,0.1:beta,0.1:beta2,0.1:rc1,0.1:rc2,0.1:stable,0.1.1,0.2,0.2:alpha,0.2:beta,0.2:stable,0.2.1,0.2.2,0.3,0.3:beta,0.3:rc1,0.3:stable,0.3.1,0.4,0.4:beta,0.4.1,0.4.2,0.5,0.5:beta,0.5:rc,0.5.1,0.5.2,0.5.3,0.5.4,0.6,0.7,0.7.1,0.7.2,0.7.3,0.8.0,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.9:beta,0.9:rc,0.9:rc2,0.9.0,0.9.1,0.9.2,0.9.3,0.9.4,and avoid the version (,0.8.6],0.1,0.1:20050811,0.1:20050820,0.1:20051007,0.1:20051021,0.1:alpha,0.1:beta,0.1:beta2,0.1:rc1,0.1:rc2,0.1:stable,0.1.1,0.2,0.2:alpha,0.2:beta,0.2:stable,0.2.1,0.2.2,0.3,0.3:beta,0.3:rc1,0.3:stable,0.3.1,0.4,0.4:beta,0.4.1,0.4.2,0.5,0.5:beta,0.5:rc,0.5.1,0.5.2,0.5.3,0.5.4,0.6,0.7,0.7.1,0.7.2,0.7.3,0.8.0,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.9:beta,0.9:rc,0.9:rc2,0.9.0,0.9.1,0.9.2,0.9.3,0.9.4