CVE-2007-1515

Horde IMP < 4.1.3 - Cross-Site Scripting via Email Subject Header or Search Parameters

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1515. PoCs published by Immerda Project Group.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Horde IMP Webmail Client due to insufficient input sanitization. It includes a sample URL demonstrating the vulnerability but lacks executable exploit code.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Immerda Project Group · textwebappsphp

https://www.exploit-db.com/exploits/29742

View Code ZIP pw:eip

The provided text describes a cross-site scripting (XSS) vulnerability in Horde IMP Webmail Client due to insufficient input sanitization. It includes a sample URL demonstrating the vulnerability but lacks executable exploit code.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Theoretical

Target: Horde IMP Webmail Client

No auth needed

Prerequisites: Access to the vulnerable web application

MITRE ATT&CK