Alt-N MDaemon Email Body HTML/JS Injection Vulnerability

vendor:

MDaemon

by:

QSecure and Demetris Papapetrou

7.5

CVSS

HIGH

HTML/JS Injection

CWE

Product Name: MDaemon

Affected Version From: v12.5.6

Affected Version To: v13.0.3

Patch Exists: YES

Related CWE:

CPE: a:alt-n:mdaemon:13.0.3

Metasploit:

Other Scripts:

Platforms Tested:

2012

Alt-N MDaemon Email Body HTML/JS Injection Vulnerability

Alt-N MDaemon is prone to an HTML/Javascript injection vulnerability because it fails to sanitize user-supplied input. Attacker-supplied HTML and/or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

Mitigation:

Upgrade to the fixed version of Alt-N MDaemon (v13.0.3 or later). Avoid inputting untrusted HTML or JavaScript code.

Source

Exploit-DB raw data:

==============================================================
   Alt-N MDaemon Email Body HTML/JS Injection Vulnerability
==============================================================

Software:  Alt-N MDaemon v13.0.3 and prior versions
Vendor: http://www.altn.com/
Vuln Type: HTML/JS Injection
Remote: Yes
Local: No
Discovered by: QSecure and Demetris Papapetrou
References: http://www.qsecure.com.cy/advisories/Alt-N_MDaemon_Email_Body_HTML_JS_Injection.html
Discovered: 14/09/2012
Reported: 19/12/2012
Fixed: 15/01/2013 (http://files.altn.com/MDaemon/Release/RelNotes_en.html)
Disclosed: 18/02/2013

VULNERABILITY DESCRIPTION:
==========================
Alt-N MDaemon is prone to an HTML/Javascript injection vulnerability
because it fails to sanitize user-supplied input.

Attacker-supplied HTML and/or JavaScript code could run in the context
of the affected site, potentially allowing the attacker to steal
cookie-based authentication credentials and control how the site is
rendered to the user; other attacks are also possible.

Alt-N MDaemon v13.0.3 & v12.5.6 were tested and found vulnerable;
other versions may also be affected.

PoC Exploit:
============
<<!-------->script>alert('XSS');<<!-------->/script>?iref=allsearch