NOCC 0.9.x - Webmail Script Injection

Author: ppp-design
type: webapps
platform: php
port: 
date_added: 2002-05-14  
date_updated: 2012-09-22  
verified: 1  
codes: CVE-2002-2343;OSVDB-58969  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 21449.txt  

source: https://www.securityfocus.com/bid/4740/info

NOCC is a web based email client implemented in PHP4. It includes support for POP3, SMTP and IMAP servers, MIME attachments and multiple languages.

A script injection issue has been reported with the way emails are displayed to users of NOCC webmail. A malicious attacker can include script code in an email and potentially get full access to a victim's mailbox.

<script>alert(document.cookie)</script>

This will show the victim's session id.