[MajorSecurity Advisory #44]MailBee WebMail Pro - Cross Site Scripting Issue

Details

Product: MailBee WebMail Pro 3.4
Security-Risk: moderated
Remote-Exploit: yes
Vendor-URL: http://www.afterlogic.com
Vendor-Status: informed
Advisory-Status: published

Credits

Discovered by: David Vieira-Kurz
http://www.majorsecurity.de

Original Advisory:

http://www.majorsecurity.de/index_2.php?major_rls=major_rls44

Introduction

"MailBee WebMail Pro is a web based mail client built as a set of ASP scripts." [from http://www.afterlogic.com]

More Details

Cross Site Scripting:
Input passed directly to the "username" parameter in "check_login.asp" is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Example:
/check_login.asp?email=>"><script>alert(15031988)</script>

Workaround

Edit the source code to ensure that input is properly sanitised.
You should work with "htmlspecialchars()" or "htmlentities()" php-function to ensure that html tags
are not going to be executed.

Example:
$email = htmlspecialchars($_POST['email']);
$test = htmlentities($_GET('test'));
?>

History/Timeline

05.04.2007 discovery of the vulnerability
06.04.2007 additional tests with other versions
08.04.2007 contacted the vendor
09.04.2007 vendor confirmed the bugs
13.04.2007 advisory is written
13.04.2007 advisory released

MajorSecurity

MajorSecurity is a non-profit German penetration testing and security research project
which consists of only one person at the present time.
http://www.majorsecurity.de/