Search...

[MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and Cookie Manipulation Issue

2007-04-11T00:00:00

ID SECURITYVULNS:DOC:16658
Type securityvulns
Reporter Securityvulns
Modified 2007-04-11T00:00:00

Description

[MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and Cookie Manipulation Issue

Details

Product: @Mail 5.0 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.atmail.com/ Vendor-Status: informed Advisory-Status: published

Credits

Discovered by: David Vieira-Kurz http://www.majorsecurity.de

Original Advisory:

http://www.majorsecurity.de/index_2.php?major_rls=major_rls43

Introduction

@Mail is a known Webmail client software. "The @Mail software powers over 5 million active email accounts worldwide." [from http://atmail.com]

More Details

Cross Site Scripting: Input passed directly to the "username" parameter in "atmail.php" is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Cookie Manipulation: Input passed directly to the "username" parameter in "atmail.php" is not properly sanitised before being returned to the user. This can be exploited to inject custom META tags to alter the cookies stored in the browser, set custom cookies and to modify the cookie information.

Workaround

Edit the source code to ensure that input is properly sanitised. You should work with "htmlspecialchars()" or "htmlentities()" php-function to ensure that html tags are not going to be executed.

Example: $username = htmlentities($_POST['username']); $test = htmlspecialchars($_GET('test')); ?>

History/Timeline

05.04.2007 discovery of the vulnerability 06.04.2007 additional tests with other versions 07.04.2007 contacted the vendor 11.04.2007 advisory is written 11.04.2007 advisory released

MajorSecurity

MajorSecurity is a non-profit German penetration testing and security research project which consists of only one person at the present time. http://majorsecurity.de/index.php?major_rls=home

JSON Vulners Source

Initial Source

{"id": "SECURITYVULNS:DOC:16658", "bulletinFamily": "software", "title": "[MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and Cookie Manipulation Issue", "description": "[MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and Cookie Manipulation Issue\r\n\r\nDetails\r\n=======\r\nProduct: @Mail 5.0 \r\nSecurity-Risk: moderated\r\nRemote-Exploit: yes\r\nVendor-URL: http://www.atmail.com/\r\nVendor-Status: informed\r\nAdvisory-Status: published\r\n\r\nCredits\r\n============\r\nDiscovered by: David Vieira-Kurz\r\nhttp://www.majorsecurity.de\r\n\r\nOriginal Advisory:\r\n============\r\nhttp://www.majorsecurity.de/index_2.php?major_rls=major_rls43\r\n\r\nIntroduction\r\n============\r\n@Mail is a known Webmail client software.\r\n"The @Mail software powers over 5 million active email accounts worldwide." [from http://atmail.com]\r\n\r\nMore Details\r\n============\r\nCross Site Scripting:\r\nInput passed directly to the "username" parameter in "atmail.php" is not properly sanitised before being returned to the user.\r\nThis can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. \r\n\r\nCookie Manipulation:\r\nInput passed directly to the "username" parameter in "atmail.php" is not properly sanitised before being returned to the user.\r\nThis can be exploited to inject custom META tags to alter the cookies stored in the browser, set custom cookies and to modify the cookie information.\r\n\r\n\r\nWorkaround\r\n=============\r\nEdit the source code to ensure that input is properly sanitised.\r\nYou should work with "htmlspecialchars()" or "htmlentities()" php-function to ensure that html tags\r\nare not going to be executed. \r\n\r\nExample:\r\n$username = htmlentities($_POST['username']);\r\n$test = htmlspecialchars($_GET('test'));\r\n?>\r\n\r\nHistory/Timeline\r\n================\r\n05.04.2007 discovery of the vulnerability\r\n06.04.2007 additional tests with other versions\r\n07.04.2007 contacted the vendor\r\n11.04.2007 advisory is written\r\n11.04.2007 advisory released\r\n\r\nMajorSecurity\r\n=======\r\nMajorSecurity is a non-profit German penetration testing and security research project\r\nwhich consists of only one person at the present time.\r\nhttp://majorsecurity.de/index.php?major_rls=home", "published": "2007-04-11T00:00:00", "modified": "2007-04-11T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:16658", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:21", "edition": 1, "viewCount": 7, "enchantments": {"score": {"value": 1.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7564"]}], "rev": 4}, "backreferences": {}, "exploitation": null, "vulnersScore": 1.5}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645333981}}