A minor Cross-site Scripting (XSS) vulnerability was found in FMBadHandler's error display. This vulnerability only happened when FMBadHandler displayed an internal error (such as failure to open a template).

The fix was implemented within 2 days of the problem being reported.

See December 2008 (below) for more information.

Cross-site Scripting (XSS) vulnerabilities were uncovered in FormMail's default error display page and FMBadHandler's error display.

To be affected by this XSS vulnerability, all the following conditions would have to be met:

• your website would need to have an "authenticated area", such as forums or a message board; and,
• your authenticated area would need to have a very large number of users (many millions); and,
• your authenticated area would need to allow persistent automatic authentication of a user (i.e. "remember me" feature); and,
• the attacker would have to create code to attack your particular website (this means the attack is not a general one); and,
• the attacker would have to convince one of your authenticated users to visit a specially-crafted website; and,
• the attacker would have to trick the user into leaving hidden windows open.

Note that the above is only theoretical. It has not been demonstrated that such an attack is possible, nor is it clear whether any useful attack could be mounted using this vulnerability.

The vulnerability is fixed in FormMail version 8.11 and FMBadHandler version 1.19.

About Cross-Site Scripting

Cross-Site Scripting (XSS) is a common vulnerability in almost all web applications and many major websites.

XSS attacks can be used for various purposes, but we believe the only realistic attack could happen under the limited circumstances described above, if possible at all.

We fixed the problem and released the new versions within 3 days of receiving a report about this. The report was generated through a general XSS vulnerability test reported to us by a FormMail user.

No exploits of this vulnerability have been reported.

A bug allowed the CAPTCHA feature to be bypassed for form submissions. Auto-responding was not affected, therefore no servers could be used as spam gateways via this bug.

This bug was uncovered by McAfee Scanning.

Fixed in version 8.10.

Versions 7.06 to 7.09 had a vulnerability if you used the new $FILE_REPOSITORY feature. The flaw was detected and fixed within 3 weeks and before the documentation for this feature was available. No known systems were affected.

Fixed in version 7.10.