SmarterMail Enterprise 4.3 - malformed mail XSS

2008.02.21
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Product: SmarterMail Enterprise 4.3 Web product: http://www.smartertools.com/Products/SmarterMail/O verview.aspx web product demo: http://maildemo.smartertools.com/Login.aspx Apparently this webmail is vulnerable to an attack xss very dangerous because it runs automatically when you open the inbox. The vulnerability is to create a malformed mail, the procedure is to add a line of code on the subject and this causes the execution of xss in your inbox. Simply add the following line of code in the subject of the mail to execute the subject: The line of code is stored in the text file by precautions that just copy and paste it into the subject of the mail to test concept http://es.geocities.com/jplopezy/SmarterMailXSS.txt I hope that will be useful greetings! Juan Pablo Lopez Yacubian fuzzertina.blogspot.com


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top