Dr_insane has discovered some vulnerabilities in FTGate Web Mail, where the most serious can be exploited by malicious people to conduct cross-site scripting attacks.

1) Input passed to the "folder" parameter in "inbox/index.fts" isn't validated before being displayed. This can be exploited to execute arbitrary HTML and script code in a logged in user's browser session in context of an affected site by tricking the user into visiting a malicious website or follow a specially crafted link.

Example:
http://[host]/inbox/index.fts?folder="><script>alert(document.domain)</script>&index=1

2) Input supplied in the "Display name" field ("name" parameter in HTTP POST request) in "addresses/individual.fts" is also not sanitised before being included in a user's personal address book. This can also be exploited to conduct cross-site scripting attacks.

3) A malicious user can gain knowledge of the installation path by requesting "inbox/message.fts" directly without any parameters.

Example:
http://[victim]/inbox/message.fts

The vulnerabilities have been confirmed in version 1.22 build 1336. Other versions may also be affected.

Solution
Filter malicious characters and character sequences in a proxy server.
Further details available in Customer Area

Provided and/or discovered by
Dr_insane

Original Advisory
http://members.lycos.co.uk/r34ct/main/FTGateOfficeFTGatePro%20V1.2.txt

Deep Links
Links available in Customer Area