Description
Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | squirrelmail | 1:1.2.6-1.4 | DSA-535 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- SquirrelMail 1.2.x - From Email Header HTML Injection EDB-24167 · webapps · Jun 3, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-535 squirrelmail - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt
- squirrelmail-from-header-xss(16285) vdb-entry
- 20040530 RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability mailing-list
- DSA-535 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=257973
- CLA-2004:858 vendor-advisory
- 10450 vdb-entry