Multiple cross-site scripting (XSS) vulnerabilities in IlohaMail 0.8.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the e-mail (1) body, (2) filename, or (3) MIME type.

Ulf Harnhammar from the Debian Security Audit Project discovered that ilohamail, a lightweight multilingual web-based IMAP/POP3 client, does not always sanitise input provided by users which allows remote attackers to inject arbitrary web script or HTML.

The target is running at least one instance of IlohaMail version 0.8.14 or earlier.  The remote version of this software is vulnerable to an HTML injection attack.  An attacker exploiting this flaw would need to convince a local user to open a malicious HTML email.  Successful exploitation would result in the victim executing potentially damaging code and possibly theft of confidential, authentication-related data.

Based on its version number, the installation of IlohaMail on the remote host does not properly sanitize attachment file names, MIME media types, and HTML / text email messages.  An attacker can exploit these vulnerabilities by sending a specially crafted message to a user which, when read using an affected version of IlohaMail, will allow the attacker to execute arbitrary HTML and script code in the user's browser within the context of the affected website.

ID	Name	Product	Family	Severity
22552	Debian DSA-1010-1 : ilohamail - missing input sanitising	Nessus	Debian Local Security Checks	medium
2828	IlohaMail < 0.8.14-RC3 read_message.php Multiple Field HTML Injection	Nessus Network Monitor	CGI	low
18050	IlohaMail read_message.php Attachment Multiple Field XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2005-1120

medium

Tenable Plugins

medium

low

medium