[ichung]

Hi guys, I'm tryna test this exploit to send an email with a payload to force a request to my imsp server to steal mail credentials. The exploit uses a vulnerability of this service called Horde that provides all the elements required for rapid web application development. The problem is when i try to send the request it gives me an error like this:

exception 'Horde_Imsp_Exception' with message 'Connection to IMSP host failed.' in /usr/share/php/Horde/Imsp/Client/Socket.php:243 Stack trace: #0 /usr/share/php/Horde/Imsp/Client/Socket.php(46): Horde_Imsp_Client_Socket->_imspOpen() #1 /usr/share/php/Horde/Core/Factory/Imsp.php(95): Horde_Imsp_Client_Socket->__construct(Array) #2 /usr/share/php/Horde/Core/Factory/Imsp.php(65): Horde_Core_Factory_Imsp->_factory('Book', Array) #3 /usr/share/horde/turba/lib/Driver/Imsp.php(89): Horde_Core_Factory_Imsp->create('Book', Array) #4 /usr/share/horde/turba/lib/Factory/Driver.php(103): Turba_Driver_Imsp->__construct('', Array) #5 /usr/share/horde/turba/merge.php(19): Turba_Factory_Driver->create(Array) #6 {main}


Was the turba_driver disabled or am i missing something? Thank you in advanced

[DramaKing]

Gemini seems pretty certain that it's as simple as a connection error. Check that your IMSP server is reachable from the client.

[ichung]

Gemini seems pretty certain that it's as simple as a connection error. Check that your IMSP server is reachable from the client.

i consulted gemini and chatGPT too and they say the same, i opened the port, but i still have a problem of permissions denied, seems impossible to do RCE or XSS in 2025 (at leasta at a basic level). Do you know if there are some tools i can look at?

[DramaKing]

i consulted gemini and chatGPT too and they say the same, i opened the port, but i still have a problem of permissions denied, seems impossible to do RCE or XSS in 2025 (at leasta at a basic level). Do you know if there are some tools i can look at?

Have you made sure that you're running a vulnerable version of the client in your test?

[AetherRoot]

I do not know what im looking at here.