Exploit TIPS MailPost 5.1.1 - Error Message Cross-Site Scripting

[Exploiter]

EDB-ID

24722

Проверка EDB

1. Пройдено

Автор

PROCHECKUP

Тип уязвимости

WEBAPPS

Платформа

CGI

CVE

cve-2004-1101

Дата публикации

2004-11-03

TIPS MailPost 5.1.1 - Error Message Cross-Site Scripting

source: https://www.securityfocus.com/bid/11598/info

MailPost is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data and can allow an attacker to execute arbitrary HTML and script code in a user's browser through a malicious error message returned from the application. 

This attack would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks. 

MailPost 5.1.1sv is reported prone to this issue. It is possible that other versions are affected as well.

http://www.example.com/scripts/mailpost.exe/<script>alert('hi')</script>/mail.txt