|Main Archive Page > Month Archives > full-disclosure-uk archives|
Affected Software/Device: SonicWall E-mail Security
Vulnerability: Cross Site Scripting
Description: SonicWALL Email Security is award-winning anti-spam, anti-virus, anti-phishing, policy, and compliance management e-mail protection solution. Available as a hardened appliance or as Windows software, SonicWALL Email Security protects inbound and outbound e-mail for organizations of less than 25 to over 100,000 users.
Sonicwall web application utilizes host header for serving 404 Error pages. The vulnerability can be exploited by requesting a non-existing web page with a specially crafted host header. As the application does not properly sanitize the data contained in the host header, desired script code can be run on client browser.
GET /blah.htm HTTP/1.1