@Mail Util.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	26635
Class:	Input Validation Error
CVE:	CVE-2007-6196
Remote:	Yes
Local:	No
Published:	Nov 27 2007 12:00AM
Updated:	Mar 19 2015 09:08AM
Credit:	The vendor disclosed this issue.
Vulnerable:	@Mail @Mail 4.13 @Mail @Mail 4.0 3 @Mail @Mail 5.1 @Mail @Mail 5.07 @Mail @Mail 5.06 @Mail @Mail 5.05 @Mail @Mail 5.04 @Mail @Mail 5.03 @Mail @Mail 5.0 @Mail @Mail 4.61 @Mail @Mail 4.6 @Mail @Mail 4.51 @Mail @Mail 4.3 @Mail @Mail 4.11 @Mail @Mail 4.03
Not Vulnerable:	@Mail @Mail 5.2

@Mail Util.PHP Cross-Site Scripting Vulnerability

@Mail is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions prior to @Mail 5.2.

@Mail Util.PHP Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

@Mail Util.PHP Cross-Site Scripting Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

@Mail Util.PHP Cross-Site Scripting Vulnerability

References:

• @Mail Homepage (@Mail)
  
• @Mail PHP Release Notes (@Mail)