Atmail Webmail Server Email Body HTML Injection Vulnerability
BID:64779
Info
Atmail Webmail Server Email Body HTML Injection Vulnerability
| Bugtraq ID: | 64779 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-6017 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 10 2014 12:00AM |
| Updated: | Jan 10 2014 12:00AM |
| Credit: | Zhao Liang, Beijing Leadsec Technology Co |
| Vulnerable: |
AtMail Atmail 7.1.3 |
| Not Vulnerable: |
AtMail Atmail 7.2 |
Discussion
Atmail Webmail Server Email Body HTML Injection Vulnerability
Atmail Webmail Server is prone to an HTML-injection vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Atmail 7.1.3 is vulnerable; others versions may also be affected.
Atmail Webmail Server is prone to an HTML-injection vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Atmail 7.1.3 is vulnerable; others versions may also be affected.
Exploit / POC
Atmail Webmail Server Email Body HTML Injection Vulnerability
Attackers can exploit this issue through a browser.
The following example data is available:
<iframe width=0 height=0 src="javascript:alert('xss in main body')">
Attackers can exploit this issue through a browser.
The following example data is available:
<iframe width=0 height=0 src="javascript:alert('xss in main body')">