[MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and Cookie Manipulation Issue
[MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and
Cookie Manipulation Issue
Details
=======
Product: @Mail 5.0
Security-Risk: moderated
Remote-Exploit: yes
Vendor-URL: http://www.atmail.com/
Vendor-Status: informed
Advisory-Status: published
Credits
============
Discovered by: David Vieira-Kurz
http://www.majorsecurity.de
Original Advisory:
============
http://www.majorsecurity.de/index_2.php?major_rls=major_rls43
Introduction
============
@Mail is a known Webmail client software.
"The @Mail software powers over 5 million active email accounts worldwide."
[from http://atmail.com]
More Details
============
Cross Site Scripting:
Input passed directly to the "username" parameter in "atmail.php" is not
properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.
Cookie Manipulation:
Input passed directly to the "username" parameter in "atmail.php" is not
properly sanitised before being returned to the user.
This can be exploited to inject custom META tags to alter the cookies stored in
the browser, set custom cookies and to modify the cookie information.
Workaround
=============
Edit the source code to ensure that input is properly sanitised.
You should work with "htmlspecialchars()" or "htmlentities()" php-function to
ensure that html tags
are not going to be executed.
Example:
$username = htmlentities($_POST['username']);
$test = htmlspecialchars($_GET('test'));
?>
History/Timeline
================
05.04.2007 discovery of the vulnerability
06.04.2007 additional tests with other versions
07.04.2007 contacted the vendor
11.04.2007 advisory is written
11.04.2007 advisory released
MajorSecurity
=======
MajorSecurity is a non-profit German penetration testing and security research
project
which consists of only one person at the present time.
http://majorsecurity.de/index.php?major_rls=home