Html injection on subscription email

Summary

A flaw in getresponse service allowed an attacker to inject HTML code in the Name field when subscribing to cs.money newsletter.

Due to a lack of sanitization in the name field of the CSMONEY newsletter registration form, it was possible to inject HTML codes, which were reflected in the confirmation email.

An attacker could insert a payload that completely modifies the visible HTML of the email, causing any victim to receive the malicious email directly from [email protected], facilitating phishing attacks.

{██████████} {F3001233}

https://email.cs.money/archive/csmoney_eng