SmarterMail Enterprise 4.3 - malformed mail XSS
Product: SmarterMail Enterprise 4.3
Web product:
http://www.smartertools.com/Products/SmarterMail/O
verview.aspx
web product demo:
http://maildemo.smartertools.com/Login.aspx
Apparently this webmail is vulnerable to an attack xss very dangerous because
it runs automatically when you open the inbox.
The vulnerability is to create a malformed mail, the procedure is to add a line
of code on the subject and this causes the execution of xss in your inbox.
Simply add the following line of code in the subject of the mail to execute the
subject:
The line of code is stored in the text file by precautions that just copy and
paste it into the subject of the mail to test concept
http://es.geocities.com/jplopezy/SmarterMailXSS.txt
I hope that will be useful greetings!
Juan Pablo Lopez Yacubian
fuzzertina.blogspot.com