bugtraq - Sun Java System Communications Express [HTML Injection]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200903102116.n2ALGpka023556@www5.securityfocus.com>
Date: Tue, 10 Mar 2009 15:16:51 -0600
From: sosoblood@...mail.com
To: bugtraq@...urityfocus.com
Subject: Sun Java System Communications Express [HTML Injection]

Hello,

I have found a HTML Injection vulnerability in Sun Java™ System Communications Express, a web client that provides an integrated web-based communication and collaboration client to the Sun Java Communications Suite. It consists of three client modules - Calendar, Address Book, and Mail.

Here is a screen-shot that demonstrates the vulnerability:
http://sosoblood.freehostia.com/SJSC/html_injection.gif

As we can see in the picture, I was able to inject some HTML and make my name in bold at the header of the page. Also, I was able to inject an image in the test message subject that I sent to myself.
One can also inject an IFRAME or any HTML tag.

However, the potential threat is limited by the limited characters size of some fields like the "Full Name" at the header of the page and the "Subject" of a message. So injecting long strings is impossible.

A solution for this vulnerability is implemented by using the htmlentities() function.

Thank you for reading.

Edgard Chammas [454447415244].