Info

Disclosure

Nov 03, 2004

Discovery

Unknown

Dates

Exploit

Nov 03, 2004

Solution

Unknown

Description

MailPost contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'append' variables upon submission to the 'mailpost.exe' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

TIPS, inc.

MailPost

5.1.1sv

References

Security Tracker: 1012070
CERT VU: 107998
Related OSVDB ID: 11410 11411 11413
Bugtraq ID: 11596
Secunia Advisory ID: 13093
ISS X-Force ID: 17953
CVE ID: 2004-1100 (see also: NVD) 2004-1101 (see also: NVD)
Vendor URL: http://www.mcenter.com/mailpost/
Other Advisory URL: http://www.procheckup.com/security_info/vuln_pr0410.html
Keyword: ProCheckUp Security Bulletin PR04-10 ProCheckUp Security Bulletin PR04-11

Credit

Gemma Hughes - gemma.hughesprocheckup.com - ProCheckUp

Direct URL: http://osvdb.org/36218