Outblaze Webmail - HTML Injection

                							

                source: http://www.securityfocus.com/bid/10756/info

Outblaze Webmail is reported prone to an-HTML injection vulnerability because the application fails to properly sanitize user-supplied HTML email content.

An attacker may be able to inject HTML and script code into the application through HTML email because it isn't properly sanitized.

An attacker can exploit this issue to access an unsuspecting user's cookie-based authentication credentials and to retrieve personal email. Other attacks are also possible.

<IMG SRC="javasc
ript:alert (document.cookie)";" border="0" height="1" width="1">