phlyLabs phlyMail Lite 4.03.04 Path Disclosure and Stored XSS Vulnerabilities
Title: phlyLabs phlyMail Lite 4.03.04 Path Disclosure and Stored XSS Vulnerabilities
Advisory ID: ZSL-2013-5122
Type: Local/Remote
Impact: Cross-Site Scripting, Exposure of system information
Risk: (3/5)
Release Date: 13.01.2013
Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a
[2] http://www.exploit-db.com/exploits/24087/
[3] http://www.securityfocus.com/bid/57304
[4] http://packetstormsecurity.com/files/119526
[5] http://www.osvdb.org/show/osvdb/89167
[6] http://www.osvdb.org/show/osvdb/89168
[7] http://secunia.com/advisories/51828/
[8] http://xforce.iss.net/xforce/xfdb/81221
[9] http://phlymail.com/en/index/news.html
[10] http://phlymail.com/forum/viewtopic.php?f=20&t=2543&p=14751#p14751
[14.01.2013] - Added reference [2]
[15.01.2013] - Added reference [3] and [4]
[16.01.2013] - Added reference [5] and [6]
[18.01.2013] - Added reference [7] and [8]
[23.01.2013] - Added vendor status and reference [9] and [10]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2013-5122
Type: Local/Remote
Impact: Cross-Site Scripting, Exposure of system information
Risk: (3/5)
Release Date: 13.01.2013
Summary
phlyMail offers you an interface in the browser to have access to your emails, contacts, appointments, tasks, files and bookmakrs from anyhwere, where you have internet access. This can be your home, workplace, train station, abroad, offroad, in the woods or your own backyard.Description
phlyMail suffers from multiple stored XSS vulnerabilities (post-auth) and Path Disclosure when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site and displaying the full webapp installation path.Vendor
phlyLabs - http://www.phlymail.comAffected Version
Lite 4.03.04Tested On
Microsoft Windows 7 Ultimate SP1 (EN)Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a
Vendor Status
[23.01.2013] Vendor releases version 4.3.57 to address these issues.PoC
phlymail_xss.htmlCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] http://cxsecurity.com/issue/WLB-2013010114[2] http://www.exploit-db.com/exploits/24087/
[3] http://www.securityfocus.com/bid/57304
[4] http://packetstormsecurity.com/files/119526
[5] http://www.osvdb.org/show/osvdb/89167
[6] http://www.osvdb.org/show/osvdb/89168
[7] http://secunia.com/advisories/51828/
[8] http://xforce.iss.net/xforce/xfdb/81221
[9] http://phlymail.com/en/index/news.html
[10] http://phlymail.com/forum/viewtopic.php?f=20&t=2543&p=14751#p14751
Changelog
[13.01.2013] - Initial release[14.01.2013] - Added reference [2]
[15.01.2013] - Added reference [3] and [4]
[16.01.2013] - Added reference [5] and [6]
[18.01.2013] - Added reference [7] and [8]
[23.01.2013] - Added vendor status and reference [9] and [10]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
