Campus Pipeline Remote Email Attachment Script Injection Vulnerability

vendor:

Campus Pipeline

by:

Unknown

7.5

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Campus Pipeline

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Campus Pipeline Remote Email Attachment Script Injection Vulnerability

The vulnerability allows remote attackers to inject and execute arbitrary script code through email attachments in Campus Pipeline. By manipulating the victim's email account, an attacker can potentially gain control of the account and steal authentication credentials. The issue is caused by the application's failure to properly sanitize user-supplied HTML and script code in email documents.

Mitigation:

Unknown

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10154/info

It has been reported that Campus Pipeline is prone to a remote email attachment script injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied HTML and script code contained in email documents.

This issue may allow a remote attacker to gain control of an unsuspecting user's email account; by executing specific script code an attacker can manipulate the victim's email account. It may be possible for an attacker to steal cookie based authentication credentials as well, and due to the integrated nature of this software this may potentially lead to further compromise of the victim's account. It should be noted that this has not been confirmed.

To delete the current email message:
<html><body onload=?deleteMessage()?></body><html>

This exploit will open a new email message with attacker-supplied text:
<html><body
onload="location.replace('http://www.example.com/cp/email/composeBody?function=new&to=attacker@example.com&subject=I
love you matt&body=I was owned by matt')"></body></html>

Site redirection:
<html><body onload="location.replace('http://www.example.com/attackerSpecified.html')">
</body></html>