NOCC Webmail Script Injection Vulnerability
BID:4740
Info
NOCC Webmail Script Injection Vulnerability
| Bugtraq ID: | 4740 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 14 2002 12:00AM |
| Updated: | May 14 2002 12:00AM |
| Credit: | Credited to ppp-design. |
| Vulnerable: |
NOCC NOCC 0.9.5 NOCC NOCC 0.9.4 NOCC NOCC 0.9.3 NOCC NOCC 0.9.2 NOCC NOCC 0.9.1 NOCC NOCC 0.9 |
| Not Vulnerable: | |
Discussion
NOCC Webmail Script Injection Vulnerability
NOCC is a web based email client implemented in PHP4. It includes support for POP3, SMTP and IMAP servers, MIME attachments and multiple languages.
A script injection issue has been reported with the way emails are displayed to users of NOCC webmail. A malicious attacker can include script code in an email and potentially get full access to a victim's mailbox.
NOCC is a web based email client implemented in PHP4. It includes support for POP3, SMTP and IMAP servers, MIME attachments and multiple languages.
A script injection issue has been reported with the way emails are displayed to users of NOCC webmail. A malicious attacker can include script code in an email and potentially get full access to a victim's mailbox.
Exploit / POC
NOCC Webmail Script Injection Vulnerability
The following proof of concept script was provided by ppp-design:
<script>alert(document.cookie)</script>
This will show the victim's session id.
The following proof of concept script was provided by ppp-design:
<script>alert(document.cookie)</script>
This will show the victim's session id.
Solution / Fix
NOCC Webmail Script Injection Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.