TYPO3 Powermail Extension HTML Injection Vulnerability

Bugtraq ID:	53885
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 08 2012 12:00AM
Updated:	Jun 08 2012 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Typo3 Powermail 1.6.6 Typo3 Powermail 1.6.5 Typo3 Powermail 1.6.4 Typo3 Powermail 1.6.3 Typo3 Powermail 1.6.2 Typo3 Powermail 1.6.1 Typo3 Powermail 1.6 Typo3 Powermail 1.5.5 Typo3 Powermail 1.5.4 Typo3 Powermail 1.5.2 Typo3 Powermail 1.5.1 Typo3 Powermail 1.1.10 Typo3 Powermail 1.1.9
Not Vulnerable:	Typo3 Powermail 1.6.7

TYPO3 Powermail Extension HTML Injection Vulnerability

The TYPO3 Powermail extension is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may exploit the HTML-injection issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is displayed, and launch other attacks.

TYPO3 Powermail versions 1.6.6 and prior are vulnerable.

TYPO3 Powermail Extension HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

TYPO3 Powermail Extension HTML Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.