Exploit GNU Mailman 2.1 - 'email' Cross-Site Scripting

[Exploiter]

EDB-ID

22198

Проверка EDB

1. Пройдено

Автор

WEBMASTER@PROCHECKUP.COM

Тип уязвимости

WEBAPPS

Платформа

CGI

CVE

cve-2003-0038

Дата публикации

2003-01-24

source: https://www.securityfocus.com/bid/6677/info

A vulnerability has been discovered in GNU Mailman. It has been reported that Mailman is prone to cross site scripting attacks. This is due to insufficient santization of URI parameters.


As a result, attackers may embed malicious script code or HTML into a link to a site running the vulnerable software. If such a link is followed, the attacker-supplied code will be interpreted in the web browser of the victim of the attack. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks are also possible.

https://www.yourserver.com:443/mailman/options/yourlist?
language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>