Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2017010049

Below is a copy:

Rumble Mail Server 0.51.3135 Cross Site Scripting# Exploit title: Rumble Mail Server v/0.51.3135 = > Stored Cross Site Scripting

# Download Software: https://sourceforge.net/projects/rumble/?source=directory

# Author: Nassim Asrir

# Author Company: Henceforth

# Contact: wassline@gmail.com 

# Tested On: Win7 


What is Rumble:
--------------------------------
Rumble is a mail server suite for SMTP (ESMTPSA), HTTP, POP3 and IMAP4v1 with an extensive C/C++ and Lua API for scripting. It comes with support for SSL/TLS, SQLite and MySQL and has a web-based administration and webmail feature. Additional included modules feature greylisting, DNS blacklisting, SpamAssassin support and dynamic performance scaling as well as a multithreaded structure that allows for clustering of multiple servers for one or all domains, and with the ease of the Lua API, you can create your own new server mailing lists, CRM software, e-marketing and other extensions within minutes.



Infos:
---------------------------------

1 - The vulnerable parametre is "domain"
 
2 - HTTP method is "POST"

Poc:
--------------------------------------

1 - Login to Admin Panel then click in "Domains & Account" or go directly from http://yourserver:2580/domains

2 - in "Domain" textbox inject the javascript code like: "><script>alert("xssed");</script>

3 - Then you get the alert box and enjoy

Copyright ©2017 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.