@Mail Multiple Cross Site Scripting Vulnerabilities
BID:14408
Info
@Mail Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 14408 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2005 12:00AM |
| Updated: | Jul 28 2005 12:00AM |
| Credit: | lostmon is credited with the discovery of this vulnerability. |
| Vulnerable: |
@Mail @Mail 4.13 @Mail @Mail 4.0 3 |
| Not Vulnerable: | |
Discussion
@Mail Multiple Cross Site Scripting Vulnerabilities
@Mail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.
@Mail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Exploit / POC
@Mail Multiple Cross Site Scripting Vulnerabilities
Some example exploits have been provided:
http://www.example.com/printcal.pl?year=[XSS-CODE]&month=11&type=4
http://www.example.com/printcal.pl?year=&month=11&type=4[XSS-CODE]
http://www.example.com/printcal.pl?type=4[XSS-CODE]
http://www.example.com/compose.pl?id=cur/1117452847.H104572P10795.www.example.com%3A2%2C&folder=Sent&cache=&func=reply&type=reply[XSS-CODE]
http://www.example.com/compose.pl?spellcheck=112253846919856.sc.new&func=spellcheck&HtmlEditor=1&unique=19944&msgtype=r[XSS-CODE]
http://www.example.com/compose.pl?spellcheck=112253846919856.sc.new&func=spellcheck&HtmlEditor=1&unique=19944[XSS-CODE]&msgtype=r
http://www.example.com/compose.pl?func=new&[email protected]&Cc=&Bcc=[XSS-CODE]
http://www.example.com/compose.pl?func=new&[email protected]&Cc=[XSS-CODE]&Bcc=
http://www.example.com/compose.pl?func=new&[email protected][XSS-CODE]&Cc=&Bcc=
http://www.example.com/webadmin/filter.pl?func=viewmailrelay&Order=IPaddress[XSS-CODE]
http://www.example.com/webadmin/filter.pl?func=filter&Header=blacklist_from&Type=1[XSS-CODE]&View=1
http://www.example.com/webadmin/filter.pl?func=filter&Header=blacklist_from[XSS-CODE]&Type=1&View=1
http://www.example.com/webadmin/filter.pl?func=filter&Header=whitelist_from&Type=0&Display=1&Sort=value[XSS-CODE]&Type=1&View=1
Some example exploits have been provided:
http://www.example.com/printcal.pl?year=[XSS-CODE]&month=11&type=4
http://www.example.com/printcal.pl?year=&month=11&type=4[XSS-CODE]
http://www.example.com/printcal.pl?type=4[XSS-CODE]
http://www.example.com/compose.pl?id=cur/1117452847.H104572P10795.www.example.com%3A2%2C&folder=Sent&cache=&func=reply&type=reply[XSS-CODE]
http://www.example.com/compose.pl?spellcheck=112253846919856.sc.new&func=spellcheck&HtmlEditor=1&unique=19944&msgtype=r[XSS-CODE]
http://www.example.com/compose.pl?spellcheck=112253846919856.sc.new&func=spellcheck&HtmlEditor=1&unique=19944[XSS-CODE]&msgtype=r
http://www.example.com/compose.pl?func=new&[email protected]&Cc=&Bcc=[XSS-CODE]
http://www.example.com/compose.pl?func=new&[email protected]&Cc=[XSS-CODE]&Bcc=
http://www.example.com/compose.pl?func=new&[email protected][XSS-CODE]&Cc=&Bcc=
http://www.example.com/webadmin/filter.pl?func=viewmailrelay&Order=IPaddress[XSS-CODE]
http://www.example.com/webadmin/filter.pl?func=filter&Header=blacklist_from&Type=1[XSS-CODE]&View=1
http://www.example.com/webadmin/filter.pl?func=filter&Header=blacklist_from[XSS-CODE]&Type=1&View=1
http://www.example.com/webadmin/filter.pl?func=filter&Header=whitelist_from&Type=0&Display=1&Sort=value[XSS-CODE]&Type=1&View=1
Solution / Fix
@Mail Multiple Cross Site Scripting Vulnerabilities
Solution:
The vendor has released a patch to address this issue:
@Mail @Mail 4.0 3
@Mail @Mail 4.13
Solution:
The vendor has released a patch to address this issue:
@Mail @Mail 4.0 3
-
@Mail patch.pl
http://calacode.com/patch.pl
@Mail @Mail 4.13
-
@Mail patch.pl
http://calacode.com/patch.pl
References
@Mail Multiple Cross Site Scripting Vulnerabilities
References:
References:
- @Mail Homepage (@Mail)
- @Mail multiple variable cross-site scripting (lostmon)