Samenvatting
A hyperlink-injection vulnerability allowed content from the "name", "company" and "phone" fields on public forms to be reflected in outgoing system e-mails. Combined with sub-address aliasing (user+tag@gmail.com), an attacker could use InterAIP.ai's trusted sending infrastructure to deliver phishing links to third parties.
No account takeover or user enumeration was possible. A secondary CRLF header-injection risk in SmtpMailer was also identified and fixed during remediation.
Credits
Met dank aan Ather Iqbal
Our thanks to Ather Iqbal (OSCP, OSWE) of Alpha Inferno Pvt Ltd for the responsible disclosure of this issue. Although this report arrived outside a formal disclosure programme, the technical detail and video PoC were high-quality and helped us remediate quickly.
