|| Security Net Advisory #D.3.12.08.a

Title : SquirrelMail Malformed HTML Mail Message Script Insertion
Impact : Cross Site Scripting
Type : Remote
Vendor :
- Url : http://www.squirrelmail.org/

|| Vulnerability

Input passed as HTML parts of e-mail messages is not properly sanitised for malformed HTML before being viewed. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when a malicious e-mail message is opened.

|| Solution:

Do not open untrusted e-mail messages.

|| Contact

Author : Ivan Markovic
Site : www.security-net.biz