Proof of Concept (PoC): ======================= The filter bypass & persistent script code inject web vulnerabilities can be exploited by remote attackers without privileged user account or direct user interaction. For security demonstration or to reproduce the vulnerability follow the provided steps and information below. Proof of Concept #1 a) Create a new email message b) In the body text, insert new HTML tag with the POC "Payload" c) Send the email to the victim d) Open the new email in the victim browser and click Reply e) You should now see a Javascript Application popup window proving the existence of this vulnerability. Proof of Concept #2 a) Goto Tools and then Account Settings b) Under the Signature Text, insert the Payload and enable 'Use HTML' c) Close the menu and Click on "Write" to create a new email d) You should get a popup the moment new Email editor window opens up proving the existence of this vulnerability. Proof of Concept #3 a) Create a new text file on your desktop (local computer) and insert the POC payload in it and save it as test.html (HTML) b) Goto Tools and then Account Settings c) Below the Signature Text box, enable 'Attach the signature from a file instead' d) Click Choose and select the 'test.html' file which you created in step a. e) Click on Write and you should be able to see the Javascript popup proving the existence of this vulnerability. Payload #1

Payload #2

1.3 POC Technical Description: Here, we used the data URI payload as a value assigned to the ‘data’ attribute of the ‘object’ tag. The