Skip to content

Instantly share code, notes, and snippets.

@tonykuo76

tonykuo76/CyberSolutions CyberMail Pre-Auth Open Redirect.md Secret

Last active August 28, 2020 04:01
Show Gist options
  • Save tonykuo76/ffdaa7bfabf2205dc5bac010eee38509 to your computer and use it in GitHub Desktop.
Save tonykuo76/ffdaa7bfabf2205dc5bac010eee38509 to your computer and use it in GitHub Desktop.
Download ZIP
CyberSolutions CyberMail Pre-Auth Open Redirect
Raw
CyberSolutions CyberMail Pre-Auth Open Redirect.md

CyberSolutions CyberMail Pre-Auth Open Redirect

Current Description

An Open Redirect vulnerability for all browsers in in CyberMail Ver.6.x and Ver.7.x, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.

Details

The injection point is ACTION parameter in "/cgi-bin/go".

We execute arbitrary code via ACTION paramemer without authentication.

Description

It could allow an unauthenticated, remote attacker to redirect a user to a malicious web page.

Affected files

http://[Target Domain]/cgi-bin/go

Contributor

  • Tony Kuo (CHT Security)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment