Gwebmail is an ajax powered webmail system with an interface similar to Gmail. It is vulnerable to XSS in the search field, DOM XSS, Flash XSS (Vulnerable SWFUpload version), Stored XSS in E-mail Subject, Stored XSS in Display Name and contacts display name, and Post Auth Local File Inclusion.
Hupa Webmail is vulnerable to stored XSS in the email subject and body. An attacker can send an email to the victim with the payload in the subject field or email body, which will be triggered in message listings (Inbox etc..). XSS payloads used are XSS POC<img src='1.jpg'onerror=javascript:alert("XSS")> and <a href=javascript:alert("AnotherXSS")>POC MAIL</a>.
Alpha Networks ADSL Wireless Routers have an administration web panel to manage the device configuration. To access the panel, the administrator has to visit the IP of the device using the port 8000 with a web browser. It will prompt for authentication. If we investigate the directory /APIS/ in the same web server we will have a fully usable API to grab information from the device. This API doesn't seem to be documented anywhere, quite weird (backdoor?). Also, this API doesn't require authentication and grant us administrator access. The implemented calls to the API are: returnWifiJSON.htm, returnInterfacesJSON.txt, returnWelcomeInfoJSON.htm, returnFirewallLevelJSON.txt, returnUsbJSON.htm, returnServicesJSON.txt, returnPasswordJSON.htm, returnLoginStatusJSON.htm, returnLoginJSON.txt, returnJSON.htm, returnIpJSON.txt, returnInternetJSON.htm, returnDhcpList.htm, returnDevicesJSON.htm, returnApplicationsListJSON.htm, returnApplicationsJSON.htm, returnApplicationJSON.txt. We can read all the configuration from the device without authentication. In addition, we have a call named returnJSON.htm that returns us the credentials of the administrator user.
A CSRF vulnerability exists in ClipBucket 2.5 which allows an attacker to add an admin user to the system. An attacker can craft a malicious HTML page containing a form with hidden fields that when loaded by an authenticated user, will submit the form and add an admin user to the system. The malicious HTML page can be hosted on a website or sent via email.
T-dah Webmail is vulnerable to Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). An attacker can exploit this vulnerability by crafting a malicious HTML page that contains a form with hidden fields. When a victim visits the malicious page, the form is automatically submitted and the attacker can inject malicious JavaScript code into the application. This code will be executed when a victim visits the application.
The XSS vulnerability is triggered by configuring a snmpd.conf file to point to an attacker-controlled JavaScript file. When a SNMP Scan is initiated, the attacker is presented with a couple of alert boxes.
IlohaMail is a PHP based lightweight full featured multilingual webmail program with IMAP and POP3 support. IlohaMail is vulnerable to Stored XSS in e-mail body and bookmarks. XSS payloads can be used in the e-mail body and vulnerable fields such as Name, Category, URL, RSS/RDF, Comments in the bookmarks. Once the user clicks on the malicious URL, the XSS should be triggered.
This module exploits a vulnerability found in the ActiveX component of Adobe Flash Player before 11.3.300.271. By supplying a corrupt Font file used by the SWF, it is possible to gain arbitrary remote code execution under the context of the user, as exploited in the wild.
A maliciously-constructed web link statement in a remote HTML document, which contains excess data argumenting an EMBED tag, could permit execution of hostile code.
A Blind-SQL injection vulnerability exists in the login form of Jaow CMS v2.3. The vulnerable page is /connexion.php and the vulnerable parameter is login. A proof-of-concept exploit is x' or (sleep(10)+1) limit 1 --, which could be used to extract the admin's hash from MySql.
Services By CQR