The vendor has acknowledged this issue and provided resolution information via customer support services. This issue has been assigned answer ID 923 by the vendor. Users should contact the vendor for more information.
It has been reported that Campus Pipeline is prone to a remote email attachment script injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied HTML and script code contained in email documents.
This issue may allow a remote attacker to gain control of an unsuspecting user's email account; by executing specific script code an attacker can manipulate the victim's email account. It may be possible for an attacker to steal cookie based authentication credentials as well, and due to the integrated nature of this software this may potentially lead to further compromise of the victim's account. It should be noted that this has not been confirmed.
To delete the current email message:
This exploit will open a new email message with attacker-supplied text:
love you matt&body=I was owned by matt')"></body></html>