Dada Mail Archives HTML Injection Vulnerability

Bugtraq ID:	14573
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2005 12:00AM
Updated:	Aug 16 2005 12:00AM
Credit:	The vendor announced this vulnerability.
Vulnerable:	Dada Mail Dada Mail 2.9.2
Not Vulnerable:	Dada Mail Dada Mail 2.10 Alpha 1

Dada Mail Archives HTML Injection Vulnerability

Dada Mail is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Dada Mail Archives HTML Injection Vulnerability

No exploit is required.

Dada Mail Archives HTML Injection Vulnerability

Solution:
The vendor has addressed this issue in version 2.10 Alpha 1:


Dada Mail Dada Mail 2.9.2

• Dada Mail dada-2_10_0-alpha1.tar.gz
  http://prdownloads.sourceforge.net/mojomail/dada-2_10_0-alpha1.tar.gz? download

Dada Mail Archives HTML Injection Vulnerability

References:

• Dada Mail 2.10 Release Notes (Dada Mail)
  
• Dada Mail Homepage (Dada Mail)