KMMail 1.0 E-Mail HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

kmMail 1.0 E-Mail HTML Injection Vulnerability. Allows attackers to inject malicious HTML and script code into emails, potentially leading to theft of authentication credentials and other possible attacks


                                                source: http://www.securityfocus.com/bid/6013/info

kmMail does not sufficiently sanitize HTML and script code from the body of e-mail messages. As a result, an attacker may send a malicious message to a user of kmMail that includes arbitrary HTML and script code.

This may allow an attacker to steal cookie-based authentication credentials from users of the webmail system. Other attacks are also possible.

&#60;b onMouseOver=&#34;alert(document.location)&#34;&#62;bolder&#60;/b&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1