0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Rumble Mail Server 0.51.3135 Cross Site Scripting Vulnerability
[# Exploit title: Rumble Mail Server v/0.51.3135 = > Stored Cross Site Scripting
# Download Software: https://sourceforge.net/projects/rumble/?source=directory
# Author: Nassim Asrir
# Author Company: Henceforth
# Contact: wassline@gmail.com
# Tested On: Win7
What is Rumble:
--------------------------------
Rumble is a mail server suite for SMTP (ESMTPSA), HTTP, POP3 and IMAP4v1 with an extensive C/C++ and Lua API for scripting. It comes with support for SSL/TLS, SQLite and MySQL and has a web-based administration and webmail feature. Additional included modules feature greylisting, DNS blacklisting, SpamAssassin support and dynamic performance scaling as well as a multithreaded structure that allows for clustering of multiple servers for one or all domains, and with the ease of the Lua API, you can create your own new server mailing lists, CRM software, e-marketing and other extensions within minutes.
Infos:
---------------------------------
1 - The vulnerable parametre is "domain"
2 - HTTP method is "POST"
Poc:
--------------------------------------
1 - Login to Admin Panel then click in "Domains & Account" or go directly from http://yourserver:2580/domains
2 - in "Domain" textbox inject the javascript code like: "><script>alert("xssed");</script>
3 - Then you get the alert box and enjoy
# 0day.today [2024-11-15] #