This vulnerability arises from improper neutralization of directives in dynamically evaluated code (eval injection) within the JScript event-script dispatcher of hMailServer. An attacker can inject arbitrary JScript by sending a password containing a backslash followed by an apostrophe in any logon that names an existing account, exploiting how event values are written as JScript string literals without properly escaping backslashes. Additional attack vectors include remote POP3 and SMTP servers via message UIDs and error replies when specific event handlers are defined. Before version 6.2.25, the injected script can create any COM object; from 6.2.25 onward, the default ScriptAllowedObjects setting '*' allows creation of objects including WScript.Shell, enabling command execution as the service account. The flaw requires event scripting enabled, JScript selected, and relevant event handlers defined, which are not default settings.

Successful exploitation allows remote, unauthenticated attackers to execute arbitrary JScript code with the privileges of the hMailServer service account, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. The vulnerability affects Windows versions of hMailServer with specific non-default configurations. Linux builds and VBScript event scripts are not affected.

No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation includes disabling event scripting or not using JScript as the script language, and avoiding defining the vulnerable event handlers (OnClientValidatePassword, OnExternalAccountDownload, OnDeliveryFailed). Since exploitation requires non-default configurations, ensuring default settings (event scripting off, VBScript language) reduces risk.