Fortinet Fortimail 7.0.1 Cross Site Scripting

Fortinet Fortimail version 7.0.1 suffers from a cross site scripting vulnerability.

MD5 | 8821726098ab76ab6471803838064aff

# Exploit Title: Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS)
# Google Dork: inurl:/fmlurlsvc/
# Date: 01-Feb-2022
# Exploit Author: Braiant Giraldo Villa
# Contact: @iron_fortress (Twitter)
# Vendor Homepage:
# Software Link: (Vendor Demo Online)
# Version:
# FortiMail version 7.0.1 and below
# FortiMail version 6.4.5 and below
# FortiMail version 6.2.7 and below
# CVE: CVE-2021-43062 (

1. Description:
An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in FortiMail may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests to the FortiGuard URI protection service.

2. Payload:
3. Proof of Concept:

4. References

Related Posts