stored XSS Protection bypass by changing the User Profile Name in thorsten/phpmyfaq
Reported on
Mar 10th 2023
Hello,
I was able to bypass the XSS Vulnerability i reported before by using this Payload.
Lets try first a normal XSS Payload which will not work
for example -> <script>alert('1')</script> -> NOT WOKRING :)
lets try the bypass payload
1'"><img/src/onerror=.1|alertAHMED-Vienna>
XSS Payload fired and its stored -> let me show you
stored XSS :)
-> it is a stored XSS.
Lets see.
Thank you for watching :)
Impact
Hello,
I was able to bypass the XSS Vulnerability i reported before by using this Payload.
Lets try first a normal XSS Payload which will not work
for example -> <script>alert('1')</script> -> NOT WOKRING :)
lets try the bypass payload
1'"><img/src/onerror=.1|alertAHMED-Vienna>
XSS Payload fired and its stored -> let me show you
stored XSS :)
-> it is a stored XSS.
Lets see.
Thank you for watching :)
Hello,
Did you publish the CVE for this Vulnerability? Cause i can not recognize the CVE assignet to it.
Thank you very much.
Hello.
Did you update the Demo Website to 3.1.12 ?
Cause i found a Vulnerability there and i do not know if you have updated the Demo Website or not yet.
Thank you very much for your time and effort.
Best regards Ahmed Hassan