CoreMail version XT3.0 suffers from a stored cross site scripting vulnerability.
f921686d976a5a7c22956d7212359350cfd0ea21e63e1684c4e814378959176a
Application: CoreMail
Versions Affected: XT3.0
Vendor URL: http://www.coremail.cn/
Bugs: Stored XSS
Author:shack.li(DBAPPSecurity Ltd)
Description:
Coremail mail system was born in 1999, is widely used in network operators, large enterprises, government institutions, colleges and universities and other mail systems, so far, the user has more than 700000000,the official website.
Vulnerability details:
Create a document, insert a hyperlink, hyperlink for executing the JavaScript test code "javascript:alert ()".
Then create a mail and upload attachments, and then send them to the other users who need them. When other users online preview documents, click the hyperlink, Attack code will be executed.
---------------------------------------------
E-mail:shack.li@dbappsecurity.com.cn
DBAppSecurity Ltd
www.dbappsecurity.com.cn