FormMail-clone Cross-Site Scripting Vulnerability

vendor:

FormMail-clone

by:

SecurityFocus

7.5

CVSS

HIGH

Cross-Site Scripting

CWE

Product Name: FormMail-clone

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

FormMail-clone Cross-Site Scripting Vulnerability

FormMail-clone is allegedly prone to cross-site scripting attacks. The FormMail-clone script does not sufficiently sanitize HTML tags and script code. As a result, a remote attacker may construct a malicious link to the script which contains arbitrary script code. If this link is visited by a web user, the attacker-supplied script code may be interpreted by their browser in the context of the site hosting the software.

Mitigation:

Input validation should be used to ensure that user-supplied data does not contain malicious HTML or script code.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/6570/info

FormMail-clone is allegedly prone to cross-site scripting attacks.

The FormMail-clone script does not sufficiently sanitize HTML tags and script code. As a result, a remote attacker may construct a malicious link to the script which contains arbitrary script code. If this link is visited by a web user, the attacker-supplied script code may be interpreted by their browser in the context of the site hosting the software.

This vulnerability was originally reported in FormMail. Additional reports have indicated that the issue actually exists in FormMail-clone, which is an entirely different program which is designed to perform the same function as FormMail but contains none of the original code.

http://www.example.com/cgi-sys/FormMail.cgi?<script>alert("test");</script>