CVEs-PoC/2020/CVE-2020-12670.md

CVE-2020-12670

Description

XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A malicious user can send any JavaScript payload into the message body and execute it if the user decides to save that email.

POC

Reference

No PoCs from references.

Github

• https://github.com/MauroEldritch/mauroeldritch