Emumail, an open source web mail application, may reveal sensitive configuration information under certain conditions. When unexpected characters are inserted into certain fields in web mail forms, the form generates an error. The error page returned may contain the directory to the web root on the Emumail server.
EmuMail is an open source web mail application available for the Unix, Linux, and Microsoft Windows operating systems. It has been reported that EmuMail does not properly sanitize input. Under some conditions, it is possible to pass an email containing script or html code through the EmuMail web mail interface. This would result in execution of the script code in the security context of the EmuMail site. Entering the string '<script>alert(document.cookie)</script>' into the email address field on the main form will cause the script to be executed when the email is viewed.
Services By CQR