Winmail Server 'badlogin.php' Cross Site Scripting Vulnerability
BID:75030
Info
Winmail Server 'badlogin.php' Cross Site Scripting Vulnerability
| Bugtraq ID: | 75030 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 30 2015 12:00AM |
| Updated: | Aug 30 2015 12:00AM |
| Credit: | Jing Wang |
| Vulnerable: |
AMAX Information Technologies Inc. Winmail Server 4.2 AMAX Information Technologies Inc. Winmail Server 4.1 |
| Not Vulnerable: | |
Discussion
Winmail Server 'badlogin.php' Cross Site Scripting Vulnerability
Winmail Server is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Winmail Server 4.2 and 4.1 are vulnerable.
Winmail Server is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Winmail Server 4.2 and 4.1 are vulnerable.
Exploit / POC
Winmail Server 'badlogin.php' Cross Site Scripting Vulnerability
Attackers can exploit this issue by enticing a user into following a malicious URI.
Attackers can exploit this issue by enticing a user into following a malicious URI.