Mail atmail.php 跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1190910 漏洞类型 跨站脚本
发布时间 2007-04-19 更新时间 2007-04-20
CVE编号 CVE-2007-2153 CNNVD-ID CNNVD-200704-370
漏洞平台 N/A CVSS评分 6.8
|漏洞来源
https://cxsecurity.com/issue/WLB-2007040101
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200704-370
|漏洞详情
Mail的atmail.php中存在跨站脚本攻击漏洞。远程攻击者可以借助用户名参数,注入任意的web脚本或HTML。
|漏洞EXP
[MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and Cookie Manipulation Issue

Details
=======
Product: @Mail 5.0 
Security-Risk: moderated
Remote-Exploit: yes
Vendor-URL: http://www.atmail.com/
Vendor-Status: informed
Advisory-Status: published

Credits
============
Discovered by: David Vieira-Kurz
http://www.majorsecurity.de

Original Advisory:
============
http://www.majorsecurity.de/index_2.php?major_rls=major_rls43

Introduction
============
@Mail is a known Webmail client software.
"The @Mail software powers over 5 million active email accounts worldwide." [from http://atmail.com]

More Details
============
Cross Site Scripting:
Input passed directly to the "username" parameter in "atmail.php" is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Cookie Manipulation:
Input passed directly to the "username" parameter in "atmail.php" is not properly sanitised before being returned to the user.
This can be exploited to inject custom META tags to alter the cookies stored in the browser, set custom cookies and to modify the cookie information.

Workaround
=============
Edit the source code to ensure that input is properly sanitised.
You should work with "htmlspecialchars()" or "htmlentities()" php-function to ensure that html tags
are not going to be executed.

Example:
$username = htmlentities($_POST['username']);
$test = htmlspecialchars($_GET('test'));
?>

History/Timeline
================
05.04.2007 discovery of the vulnerability
06.04.2007 additional tests with other versions
07.04.2007 contacted the vendor
11.04.2007 advisory is written
11.04.2007 advisory released

MajorSecurity
=======
MajorSecurity is a non-profit German penetration testing and security research project
which consists of only one person at the present time.
http://majorsecurity.de/index.php?major_rls=home
|参考资料

来源:XF
名称:@mail-atmail-xss(33591)
链接:http://xforce.iss.net/xforce/xfdb/33591
来源:BID
名称:23428
链接:http://www.securityfocus.com/bid/23428
来源:BUGTRAQ
名称:20070411[MajorSecurityAdvisory#43]CalacodeATMail5.0-CrossSiteScriptingandCookieManipulationIssue
链接:http://www.securityfocus.com/archive/1/archive/1/465378/100/100/threaded
来源:MISC
链接:http://www.majorsecurity.de/index_2.php?major_rls=major_rls43
来源:SREASON
名称:2594
链接:http://securityreason.com/securityalert/2594