@Mail and @Mail WebMail Email Body HTML Injection Vulnerability
BID:34529
Info
@Mail and @Mail WebMail Email Body HTML Injection Vulnerability
| Bugtraq ID: | 34529 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 15 2009 12:00AM |
| Updated: | Apr 16 2009 10:56PM |
| Credit: | Julien Cayssol |
| Vulnerable: |
AtMail @Mail WebMail 5.6 AtMail @Mail 5.6 |
| Not Vulnerable: |
AtMail @Mail WebMail 5.61 AtMail @Mail 5.61 |
Discussion
@Mail and @Mail WebMail Email Body HTML Injection Vulnerability
@Mail and @Mail WebMail are prone to an HTML-injection vulnerability because the applications fail to properly sanitize user-supplied input before using it in dynamically generated content.
Hostile HTML and script code may be injected into vulnerable sections of the application. When viewed, this code may be rendered in the browser of a user viewing a malicious site.
@Mail and @Mail WebMail are prone to an HTML-injection vulnerability because the applications fail to properly sanitize user-supplied input before using it in dynamically generated content.
Hostile HTML and script code may be injected into vulnerable sections of the application. When viewed, this code may be rendered in the browser of a user viewing a malicious site.
Exploit / POC
@Mail and @Mail WebMail Email Body HTML Injection Vulnerability
Attackers can exploit this issue via a browser.
Attackers can exploit this issue via a browser.
Solution / Fix
@Mail and @Mail WebMail Email Body HTML Injection Vulnerability
Solution:
The vendor released @Mail and @Mail WebMail 5.61 to address this issue. Please see the references for more information.
Solution:
The vendor released @Mail and @Mail WebMail 5.61 to address this issue. Please see the references for more information.
References
@Mail and @Mail WebMail Email Body HTML Injection Vulnerability
References:
References:
- @Mail Homepage (@Mail)
- @Mail PHP Version 5.61 Release (@Mail)