PSCS VPOP3 Email Server WebAdmin Cross-Site Scripting Vulnerability
BID:8869
Info
PSCS VPOP3 Email Server WebAdmin Cross-Site Scripting Vulnerability
| Bugtraq ID: | 8869 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 22 2003 12:00AM |
| Updated: | Oct 22 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to SecurITeam Experts. |
| Vulnerable: |
PSCS VPOP3 2.0 f PSCS VPOP3 2.0 e |
| Not Vulnerable: |
PSCS VPOP3 2.0 g |
Discussion
PSCS VPOP3 Email Server WebAdmin Cross-Site Scripting Vulnerability
It has been reported that PSCS VPOP3 Email Server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to embed malicious HTML and script code in a link. The issue is reported to be present in the WebAdmin utility of the software because of improper sanitization of user-supplied data that will be displayed by the utility.
Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.
PSCS VPOP3 versions 2.0.0e and 2.0.0f have been reported to be prone to this vulnerability, however other versions may be affected as well.
It has been reported that PSCS VPOP3 Email Server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to embed malicious HTML and script code in a link. The issue is reported to be present in the WebAdmin utility of the software because of improper sanitization of user-supplied data that will be displayed by the utility.
Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.
PSCS VPOP3 versions 2.0.0e and 2.0.0f have been reported to be prone to this vulnerability, however other versions may be affected as well.
Exploit / POC
PSCS VPOP3 Email Server WebAdmin Cross-Site Scripting Vulnerability
The following proof of concept has been provided:
index.html?redirect=admin/index.html";%0Devil_script;%0D//
The following proof of concept has been provided:
index.html?redirect=admin/index.html";%0Devil_script;%0D//
Solution / Fix
PSCS VPOP3 Email Server WebAdmin Cross-Site Scripting Vulnerability
Solution:
The vendor has released an updated version 2.0.0g to address this issue. Please contact the vendor for more information about obtaining fixes.
Solution:
The vendor has released an updated version 2.0.0g to address this issue. Please contact the vendor for more information about obtaining fixes.
References
PSCS VPOP3 Email Server WebAdmin Cross-Site Scripting Vulnerability
References:
References:
- VPOP3 Homepage (PSCS)