Code-Crafters Ability Mail Server 1.18 errormsg Parameter XSS

2004-07-12T00:00:00
ID EDB-ID:24268
Type exploitdb
Reporter dr_insane
Modified 2004-07-12T00:00:00

Description

Code-Crafters Ability Mail Server 1.18 errormsg Parameter XSS. CVE-2004-2494. Remote exploits for multiple platform

                                        
                                            source: http://www.securityfocus.com/bid/10695/info

Ability Mail Server is reported prone to multiple vulnerabilities that may allow a remote attacker to carry out cross-site scripting and denial of service attacks.

The server is prone to a cross-site scripting vulnerability that may allow an attacker to execute arbitrary HTML and script code in the browser of a vulnerable user.

It is reported that the mail server is also prone to a denial of service vulnerability. This issue presents itself when an attacker establishes about 150-200 connections to various services such as SMTP, POP3, View FeaturesIMAP4, WebMail etc.

These issue are reported to affect Ability Mail Server version 1.18, however, other versions may be affected as well.

http://www.example.com/_error?id=[id]&errormsg=<script>alert(document.cookie)</script>