# Exploit title: Rumble Mail Server v/0.51.3135 = > Stored Cross Site Scripting # Download Software: https://sourceforge.net/projects/rumble/?source=directory # Author: Nassim Asrir # Author Company: Henceforth # Contact: wassline@gmail.com # Tested On: Win7 What is Rumble: -------------------------------- Rumble is a mail server suite for SMTP (ESMTPSA), HTTP, POP3 and IMAP4v1 with an extensive C/C++ and Lua API for scripting. It comes with support for SSL/TLS, SQLite and MySQL and has a web-based administration and webmail feature. Additional included modules feature greylisting, DNS blacklisting, SpamAssassin support and dynamic performance scaling as well as a multithreaded structure that allows for clustering of multiple servers for one or all domains, and with the ease of the Lua API, you can create your own new server mailing lists, CRM software, e-marketing and other extensions within minutes. Infos: --------------------------------- 1 - The vulnerable parametre is "domain" 2 - HTTP method is "POST" Poc: -------------------------------------- 1 - Login to Admin Panel then click in "Domains & Account" or go directly from http://yourserver:2580/domains 2 - in "Domain" textbox inject the javascript code like: "><script>alert("xssed");</script> 3 - Then you get the alert box and enjoy