SqWebMail Email Header HTML Injection Vulnerability

SqWebMail is reported to be prone to an email header HTML injection vulnerability. This issue presents itself due to a failure of the application to properly sanitize user-supplied email header strings.

The problem presents itself when an unsuspecting user views an email message containing malicious HTML and script code in the email header.

An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials.


Privacy Statement
Copyright 2010, SecurityFocus