AOH :: HP Unsorted S :: BX1996.HTM

SmarterMail Enterprise 4.3 - malformed mail XSS



SmarterMail Enterprise 4.3 - malformed mail XSS
SmarterMail Enterprise 4.3 - malformed mail XSS





Product: SmarterMail Enterprise 4.3

Web product:

http://www.smartertools.com/Products/SmarterMail/O
verview.aspx

web product demo:

http://maildemo.smartertools.com/Login.aspx


Apparently this webmail is vulnerable to an attack xss very dangerous because it runs automatically when you open the inbox.
The vulnerability is to create a malformed mail, the procedure is to add a line of code on the subject and this causes the execution of xss in your inbox.

Simply add the following line of code in the subject of the mail to execute the subject:

The line of code is stored in the text file by precautions that just copy and paste it into the subject of the mail to test concept

http://es.geocities.com/jplopezy/SmarterMailXSS.txt


I hope that will be useful greetings!


Juan Pablo Lopez Yacubian
fuzzertina.blogspot.com




The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.