bugtraq - SmarterMail Enterprise 4.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080219024101.2922.qmail@securityfocus.com>
Date: 19 Feb 2008 02:41:01 -0000
From: jplopezy@...il.com
To: bugtraq@...urityfocus.com
Subject: SmarterMail Enterprise 4.3  - malformed mail XSS

Product: SmarterMail Enterprise 4.3

Web product: 

http://www.smartertools.com/Products/SmarterMail/O
verview.aspx

web product demo:

http://maildemo.smartertools.com/Login.aspx

Apparently this webmail is vulnerable to an attack xss very dangerous because it runs automatically when you open the inbox. 
The vulnerability is to create a malformed mail, the procedure is to add a line of code on the subject and this causes the execution of xss in your inbox. 

Simply add the following line of code in the subject of the mail to execute the subject: 

The line of code is stored in the text file by precautions that just copy and paste it into the subject of the mail to test concept

http://es.geocities.com/jplopezy/SmarterMailXSS.txt

I hope that will be useful greetings!

Juan Pablo Lopez Yacubian
fuzzertina.blogspot.com