SOGo <= 5.12.4 XSS Vulnerability

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:alinto:sogo";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.125136");
  script_version("2025-12-05T15:41:30+0000");
  script_tag(name:"last_modification", value:"2025-12-05 15:41:30 +0000 (Fri, 05 Dec 2025)");
  script_tag(name:"creation_date", value:"2025-12-05 08:39:50 +0000 (Fri, 05 Dec 2025)");
  script_tag(name:"cvss_base", value:"4.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:N/I:P/A:N");

  script_cve_id("CVE-2025-63499");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"NoneAvailable");

  script_name("SOGo <= 5.12.4 XSS Vulnerability");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_sogo_http_detect.nasl");
  script_mandatory_keys("sogo/detected");

  script_tag(name:"summary", value:"SOGo is prone to a cross-site scripting (XSS) vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"SOGo is vulnerable to Cross Site Scripting (XSS) via the theme
  parameter. An attacker can exploit this vulnerability to inject malicious scripts into the
  application. To exploit this vulnerability, the attacker needs to know the victim's email
  address and the victim must have a valid SOGo session.");

  script_tag(name:"affected", value:"SOGo version 5.12.4 and prior.");

  script_tag(name:"solution", value:"No known solution is available as of 05th December, 2025.
  Information regarding this issue will be updated once solution details are available.");

  script_xref(name:"URL", value:"https://github.com/poblaguev-tot/CVE-2025-63499");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!port = get_app_port(cpe: CPE))
  exit(0);

if (!version = get_app_version(cpe: CPE, port: port))
  exit(0);

if (version_is_less_equal(version: version, test_version: "5.12.4")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "None");
  security_message(port: port, data: report);
  exit(0);
}

exit(0);