NOCC 0.9.x Webmail Script Injection Vulnerability

2002-05-14T00:00:00
ID EDB-ID:21449
Type exploitdb
Reporter ppp-design
Modified 2002-05-14T00:00:00

Description

NOCC 0.9.x Webmail Script Injection Vulnerability. CVE-2002-2343. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/4740/info

NOCC is a web based email client implemented in PHP4. It includes support for POP3, SMTP and IMAP servers, MIME attachments and multiple languages.

A script injection issue has been reported with the way emails are displayed to users of NOCC webmail. A malicious attacker can include script code in an email and potentially get full access to a victim's mailbox. 

<script>alert(document.cookie)</script>

This will show the victim's session id.