POC详情： a73578a58012e7b140b930de926779be5ab0f144

描述

A Cross-Site Scripting (XSS) vulnerability

介绍

## Cross-Site Scripting (XSS) in DonWeb Ferozo Webmail (CVE-2024-50962)


### Description
A Cross-Site Scripting (XSS) vulnerability in **Ferozo Webmail v1.1** allows attackers to execute arbitrary scripts via the **Identities** and **Automatic Responses** components. This vulnerability can be used to hijack user sessions, conduct phishing attacks, and steal credentials.

### Attack Complexity
- **Low**

### Privileges Required
- **None**

### User Interaction
- **Required** (Users need to interact with the component containing the injected script.)

### Affected Components
- **Identities Page and Automatic Responses**: Insufficient input validation allows malicious script injection.

### Impact
- **Session Hijacking**: Attackers can control user sessions.
- **Phishing**: Embedded iframes can be used to conduct phishing attacks.

### Remediation
- **Input Sanitization**: Implement robust input validation and sanitization.
- **XSS Filtering**: Apply a Content Security Policy (CSP) to prevent unauthorized script execution.

---
**CVE-2024-50962**  
*Reported by [Facundo Fernandez / Security Researcher]*

文件快照

 [4.0K]  /data/pocs/a73578a58012e7b140b930de926779be5ab0f144
└── [1.1K]  README.md

0 directories, 1 file

备注