There are some XSS Vulnerabilities in FTD v3.7.3 and prior.
XSS attacks (HTML / Javascript codes) will launch if they are submitted as a search in the search bar.
They will also be launched when sent as a mail to yourself or a victim.
Proof of Concept:
To make sure it launches, you just need to add a word or a normal character before your code.
Example: Hello <script>alert(1);</script> !
If you ignore this and you send you mail without adding a character before your code, you could get this problem:
If you send '<script>alert(1);</script>',
it'll become 'Alert(1);'.
This is because the program wants to correct the first letter, it will try to make the first letter a capital one.
FTD: http://www.binaries4all.nl/ftd/
O.G.
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum