Multiple stored XSS vulnerabilities in a function of Coremail

Multiple stored XSS vulnerabilities in a function of Coremail

Coremail can import contacts in the personal address book in csv format.

Import the following CSV file:

Contact Group, name, email address, residential address, residential address zip code, residential phone number, mobile phone number, organization, business address, business address zip code, business phone number, business fax, birthday, real-time information address, webpage ,__ cm_groupaaaaa, @ qq.com, 13132132132, 19881212, javascript: alert (1), Friend = ,,,,,,,,,,,,,,, FAMILY =, COWORKERS = ,,,,,,,,,,,,,,, NETFRIENDS = netizen, VIP = important contact

It can be seen that the home page has been escaped and is not triggered:

However, there are trigger issues on each function page, as shown below: 1. trigger when creating a Contact Group:


2. triggered when the contact is printed:


3. triggered when editing the group:


4. triggered when clearing the contact email:

Solution:

Dom operation to filter this filter