[SA18776] V-webmail Cross-Site Scripting and Path Disclosure

TITLE:
V-webmail Cross-Site Scripting and Path Disclosure

SECUNIA ADVISORY ID:
SA18776

VERIFY ADVISORY:
http://secunia.com/advisories/18776/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting, Exposure of system information

WHERE:
>From remote

SOFTWARE:
V-webmail 1.x
http://secunia.com/product/8122/

DESCRIPTION:
$um$id has reported a vulnerability and two weaknesses in V-webmail,
which can be exploited by malicious people to gain knowledge of
certain system information, and to conduct phishing and cross-site
scripting attacks.

1) Input passed to the "newid" parameter in preferences.personal.php
isn't properly sanitised before being returned to the user. This can
be exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

Example:
http://[host]/preferences.personal.php?newid=[code]

2) Input passed to the "rframe" parameter in frameset.php isn't
verified before it is being used to include arbitrary webpage in the
webmail's frameset. This can potentially be exploited to conduct
phishing attacks.

Example:
http://[host]/frameset.php?vwebmailsession=&rframe=[url]

3) Accessing "help.php" with invalid parameters discloses path
information.

The vulnerability and weaknesses have been reported in version 1.6.2.
Other version may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY:
$um$id

---

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.