|
|
SquirrelMail Email Header HTML Injection Vulnerability
No exploit is required to leverage this issue. Successful exploitation is reported to depend on the IMAP server used to parse the offending email. The following proof of concept value of 'Content-Type' has been provided: Content-Type: application/octet-stream"<script>window.alert(document.cookie)</script>"; name=top_secret.pdf |
|
Privacy Statement |