T-dah is an Open Sourced Universal Webmail origially developed by Aldoir Ventura under the name Uebimiau in which we picked up late in 2007. It is free and can be installed on any server that supports PHP. There are four stored XSS vulnerabilities in the application. The first is an XSS in the message body (HREF) which can be triggered when the user clicks the link. The second is a stored XSS in the email body which can be triggered when the user opens the message. The third is a stored XSS in contacts which can be triggered when creating a new contact. The fourth is a stored XSS in the calendar which can be triggered when adding a new event.
Hastymail2 is a full featured IMAP/SMTP client written in PHP. A stored XSS vulnerability exists in the email subject in Thread View. An attacker can send an email to the victim with a malicious payload in the subject field. When the client opens the message and selects 'Thread View' the XSS will be triggered.
Inferno vBShout is vulnerable to a SQL Injection vulnerability due to improper sanitization of user-supplied input in the 'do' parameter of the 'infernoshout.php' script. An attacker can exploit this vulnerability to gain access to sensitive information such as usernames, passwords, and salts stored in the database.
Multiple persistent input validation vulnerabilities are detected in the Social Engine v4.2.5 web application. The bug allows an attackers to implement/inject malicious script code on the application side (persistent). The persistent vulnerabilities are located in the add- new videos and classiefieds module with the bound vulnerable tag (keywords) parameter. A non persistent cross site scripting vulnerability is detected in the Social Engine v4.2.5 web application. The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with medium or high required user inter action or local low privileged user account. The bug is located in the signup (profile) module with the bound vulnerable name and address parameters.
A CSRF vulnerability exists in Jaow CMS v2.3 which allows an attacker to add an admin user to the system. An attacker can craft a malicious HTML page containing a form with hidden fields that when loaded by an authenticated user, will submit the form and add an admin user to the system. The malicious HTML page can be hosted on a website or sent via email.
ESVA (E-Mail Security Virtual Appliance) is a pre-built and semi-configured email scanning appliance that will run on VMware Workstation, Server, Player or ESX Server. Attacker can easily execute command using the infected files 'learn-msg.cgi' and 'release-msg.cgi' without any strips/filter to metacharacters.
A CSRF vulnerability exists in ProQuiz v2.0.2 which allows an attacker to change the admin password by sending a malicious POST request. The attacker can craft a malicious HTML page containing a form with hidden fields and submit it to the vulnerable application. The application will then process the request and change the admin password to the value specified in the hidden field.
Send an email to the victim with the payload in the email body, Once the user clicks on the url the XSS should be triggered. In order to trigger this XSS you should insert the payload into your signature.
The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka 'Time Element Memory Corruption Vulnerability.'
Due to improper input sanitation, parameters are prone to SQL injection. Stored crossed site scripting is also present in some forms. PoC 1: SQL Injection Page: view_topic.php / view_profile.php? Vulnerable param: 'id' http://172.16.194.148/sphpforum/sphpforum-0.4/view_topic.php?id=50%27%20and%20sleep%2810%29%20and%20%271%27=%271 http://172.16.194.148/sphpforum/sphpforum-0.4/view_profile.php?id=loneferret%27%20and%20sleep%2810%29%20and%20%271%27=%271 PoC 2: Stored XSS Page: create_topic.php Vulnerable field: Topic Payload: <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Services By CQR