smartermail-xss.txt

`  
  
Product: SmarterMail Enterprise 4.3  
  
Web product:   
  
http://www.smartertools.com/Products/SmarterMail/O  
verview.aspx  
  
web product demo:  
  
http://maildemo.smartertools.com/Login.aspx  
  
  
Apparently this webmail is vulnerable to an attack xss very dangerous because it runs automatically when you open the inbox.   
The vulnerability is to create a malformed mail, the procedure is to add a line of code on the subject and this causes the execution of xss in your inbox.   
  
Simply add the following line of code in the subject of the mail to execute the subject:   
  
<XSS STYLE="xss:expression(alert('1'))"><XSS STYLE="xss:expression(alert('2'))">  
  
  
I hope that will be useful greetings!  
  
  
Juan Pablo Lopez Yacubian  
fuzzertina.blogspot.com  
  
  
`