CVE-2001-0857

IMP Webmail < 2.2.6 - Cross-Site Scripting via Status Message Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2001-0857. PoCs published by Joao Pedro Goncalves.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Horde IMP's status.php3. The crafted URL injects JavaScript to steal cookie-based authentication credentials by sending them to an attacker-controlled server.

Description

Cross-site scripting vulnerability in status.php3 in Imp Webmail 2.2.6 and earlier allows remote attackers to gain access to the e-mail of other users by hijacking session cookies via the message parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Joao Pedro Goncalves · textremotelinux

https://www.exploit-db.com/exploits/21151

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Horde IMP's status.php3. The crafted URL injects JavaScript to steal cookie-based authentication credentials by sending them to an attacker-controlled server.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Horde IMP (version not specified)

No auth needed

Prerequisites: Victim must click a malicious link

MITRE ATT&CK