SuperWebMailer 9.31.0.01799 has a reflective XSS vulnerability

[Hebing123]

Summary

SuperWebMailer 9.31.0.01799 has a reflective cross-site vulnerability.

Details

SuperWebMailer in version 9.31.0.01799 has a reflection cross-site attack vulnerability caused by api.php directly referencing urls without filtering.

Proof of Concept (POC)

http://ip:port/api/api.php/%3Cscript%3Ealert(1)%3C/script%3E
Test case
https://newsletter-software-php-script.superwebmailer.de/api/api.php/%3Cscript%3Ealert(1)%3C/script%3E

Zugangsdaten zur Anmeldung
Benutzername: demo
Kennwort: demo

Impact

If a user or administrator accesses the malicious url, the cookie may be obtained by an attacker.

[Hebing123]

This is the vulnerability exploitation reference for CVE-2024-24131