DList (dlist.exe) in DMail 3.1a allows remote attackers to bypass authentication read log files and shutdown the system via a sendlog command with an incorrect password hash which is not properly handled by the _cmd_sendlog function.