Zimbra offers Open Source email server software and shared calendar for Linux and the Mac
Go Back   Zimbra :: Forums > Zimbra Collaboration Suite > Administrators

Welcome to the Zimbra :: Forums!
Welcome, if you would like to post a comment please register. We also encourage you to explore all things Zimbra with our team and members of the community.

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1 (permalink)  
Old 12-05-2010, 10:45 PM
Starter Member
 
Posts: 2
Default zcs-6.0.9_GA_2686.UBUNTU8_64 get hacked

Hi all,

I have a trouble these day, i have reported a upload file error from user,
so i check the source code , i found thses at attactment upload page @ ajax(after user attact the file).

someone hack and append some js into it,

anyone have idea?

Ths

Francis

<iframe name="DWT81" id="DWT81" src='javascript:""' style="position: absolute; top: 0; left: 0; visibility: hidden">
<html>
<head>
<script src="http://www.pkupe.com/images/pic.js"></<html><head><script language='javascript'>
function doit() { window.parent._uploadManager.loaded(200,'0',[{"aid":"2f61a054-5a8c-4e6a-a9bb-e95c1fdbe245:abc0a22c-1ffa-4665- be11-05fec1280d76","ct":"application/zip","filename":"All-2010-10-18-161702.tgz.download","s":16235546}]); }
</script>
</head>
<body onload="doit()">
</body>
</html>
</iframe>
Reply With Quote
  #2 (permalink)  
Old 12-07-2010, 10:31 AM
Zimbra Employee
 
Posts: 580
Default

Our upload servlet puts that code in so that the application can respond when an upload finishes.
__________________
Quanah Gibson-Mount
Sr. Member of Technical Staff
Zimbra, Inc
A Division of VMware, Inc.
--------------------
Zimbra :: the leader in open source messaging and collaboration
Reply With Quote
Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Similar Threads

Why Join?

Registering let's you ask questions, makes it easier to search, displays any files attached to posts, and notifies you about replies.

blog.zimbra.com




 

SEO by vBSEO ©2011, Crawlability, Inc.