Article reference: http://www.securiteam.com/windowsntfocus/5EP0I15CKK.html
Beyond Security has discovered a security vulnerability in <http://www.zaep.com/> Zaep AntiSpam 2.0, the vulnerability would allow a remote attacker to use the Zaep program's CGI to cause it to return third party content as if it were its own (A cross-site scripting vulnerability). This vulnerability would allow (depending on the web server's configuration and site sensitivity) to steal cookies, display alternative information (cross-site defacement), or redirect users to malicious sites.
Vulnerable Systems: * Zaep AntiSpam 2.0
Immune Systems: * Zaep AntiSpam 220.127.116.11
Exploit (for all the vulnerabilities): http://vulnerable.zaep/?key=<script>alert(document.cookie)<%252Fscript>
Vendor response: The vendor has been very cooperative and has issued a patch to fix this problem as soon as they were notified.
The information has been provided by <mailto:firstname.lastname@example.org> Noam Rathaus.
DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html