<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<tt>Hi,<br>
<br>
Barracuda offers their "Barracuda Vulnerability Manager" for free
at the moment and I tested it.<br>
<a class="moz-txt-link-freetext" href="https://bvm.barracudanetworks.com/">https://bvm.barracudanetworks.com/</a><br>
<br>
<br>
Here some of the results pointed at my ZendTo installation:<br>
<br>
<br>
Reflected Cross-Site Scripting<br>
==============================<br>
<a class="moz-txt-link-freetext" href="https://your.url.tld/pickup.php">https://your.url.tld/pickup.php</a><br>
Issue Detail<br>
The emailAddr parameter was submitted with the value
"--><script>prompt(12345)</script>lNYCi<!--, and
the string was echoed verbatim in the output, showing that there
is a reflected XSS vulnerability.<br>
<br>
<a class="moz-txt-link-freetext" href="https://your.url.tld/pickup.php">https://your.url.tld/pickup.php</a><br>
Issue Detail<br>
The auth parameter was submitted with the value
"--><script>prompt(12345)</script>HyNzQ<!--, and
the string was echoed verbatim in the output, showing that there
is a reflected XSS vulnerability.<br>
<br>
<a class="moz-txt-link-freetext" href="https://your.url.tld/pickup.php">https://your.url.tld/pickup.php</a><br>
Issue Detail<br>
The emailAddr parameter was submitted with the value
"--><script>prompt(12345)</script>x7RXs<!--, and
the string was echoed verbatim in the output, showing that there
is a reflected XSS vulnerability.<br>
<br>
<a class="moz-txt-link-freetext" href="https://your.url.tld/pickup.php">https://your.url.tld/pickup.php</a><br>
Issue Detail<br>
The auth parameter was submitted with the value
"--><script>prompt(12345)</script>WqYcq<!--, and
the string was echoed verbatim in the output, showing that there
is a reflected XSS vulnerability.<br>
<br>
HTML-Injection<br>
</tt><tt><tt>==============<br>
</tt><a class="moz-txt-link-freetext" href="https://your.url.tld/pickup.php">https://your.url.tld/pickup.php</a><br>
Issue Detail<br>
The emailAddr parameter was submitted with the value
<h1>tjkgr</h1>, and this value was echoed back
verbatim in the resulting page.<br>
<br>
<a class="moz-txt-link-freetext" href="https://your.url.tld/pickup.php">https://your.url.tld/pickup.php</a><br>
Issue Detail<br>
The auth parameter was submitted with the value
<h1>xt90x</h1>, and this value was echoed back
verbatim in the resulting page.<br>
<br>
<a class="moz-txt-link-freetext" href="https://your.url.tld/pickup.php">https://your.url.tld/pickup.php</a><br>
Issue Detail<br>
The emailAddr parameter was submitted with the value
<h1>zrjja</h1>, and this value was echoed back
verbatim in the resulting page.<br>
View Full HTTP Request and Response<br>
<br>
<a class="moz-txt-link-freetext" href="https://your.url.tld/pickup.php">https://your.url.tld/pickup.php</a><br>
Issue Detail<br>
The auth parameter was submitted with the value
<h1>anhxx</h1>, and this value was echoed back
verbatim in the resulting page.<br>
<br>
Kind regards<br>
<br>
PCFreak<br>
<br>
<br>
<br>
<br>
</tt><br>
<div class="moz-cite-prefix">On 01.03.2016 20:14, Chris Venter
wrote:<br>
</div>
<blockquote
cite="mid:CAPgmoWbKJhuO28MxfTko_d3AfipunRC7d45N-sZ30Vmo6hssdQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>Hi <br>
<br>
</div>
Our security audit has highlighted a possible reflected
cross site scripting error on the pickup.php page,to
test we ran <br>
<br>
<a moz-do-not-send="true"
href="https://server_name/pickup/php?emailAddr=test"
target="_blank">https://server_name/pickup/php?emailAddr=test</a>"
/><script>alert('XSS Test')</script><br>
</div>
<br>
</div>
Can anyone else confirm if this is an issue?<br>
<br>
</div>
Thanks<br>
</div>
CJ</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
ZendTo mailing list
<a class="moz-txt-link-abbreviated" href="mailto:ZendTo@zend.to">ZendTo@zend.to</a>
<a class="moz-txt-link-freetext" href="http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto">http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto</a></pre>
</blockquote>
<br>
</body>
</html>