MailEnable Reflected Cross-Site Scripting Vulnerability in Webmail Interface

A reflected cross-site scripting vulnerability has been identified in the MailEnable webmail interface, affecting versions prior to 10.55. This vulnerability allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. The issue arises in the ManageShares.aspx form, where the SelectedIndex parameter is not properly sanitized before being embedded in dynamically generated JavaScript, enabling the injection of malicious code.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute JavaScript in the context of the victim's browser.

Reproduction

To reproduce this vulnerability, send a request to the MailEnable webmail interface's ManageShares.aspx page, including a crafted URL that exploits the SelectedIndex parameter. The unsanitized input will be reflected in the JavaScript context, executing the injected script.

Remediation

Users are advised to upgrade to MailEnable version 10.55 or later.