• info
• discussion
• exploit
• solution
• references

IlohaMail Email Header HTML Injection Vulnerability

IlohaMail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings.

An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials; disclosure of personal email is possible. Other attacks are also possible.

IlohaMail 0.8.12 and prior are prone to this issue.