Tickets :: Comment on [#5063] HTML INJECT Vulenrability

* Your Email Address
* Spam protection	Enter the letters below: . ..__ .__ .__ . . \|\ \|[__)[__)[__)\|_/ \| \\|[__)\| \\| \| \
Comment	> Horde IMP is prone to an HTML injection vulnerability. This issue is > due to a failure in > > the application to properly sanitize variable 'url'. > > > > Attacker-supplied HTML and script code would be executed in the > context of the affected > > Web site, potentially allowing for theft of cookie-based > authentication credentials. An > > attacker could also exploit this issue to control how the site is > rendered to the user; > > other attacks are also possible. > > > > This would effect even an unauthenticated user which could be > directed to a malicious web page resulting in information theft or > even system compromise by injecting Trojans. > > > > PROOF OF CONCEPT CODE: > > > > > > http://<HOST>/index.php?url=<any web.html> > > > > A prompt responce will be highly appreciated. > > > > Thankyou > > Abdus Samad > > Advanced Research Projects and Technologies > >
Attachment
Watch this ticket