9 lines
No EOL
506 B
Text
9 lines
No EOL
506 B
Text
source: http://www.securityfocus.com/bid/4740/info
|
|
|
|
NOCC is a web based email client implemented in PHP4. It includes support for POP3, SMTP and IMAP servers, MIME attachments and multiple languages.
|
|
|
|
A script injection issue has been reported with the way emails are displayed to users of NOCC webmail. A malicious attacker can include script code in an email and potentially get full access to a victim's mailbox.
|
|
|
|
<script>alert(document.cookie)</script>
|
|
|
|
This will show the victim's session id. |