| शीर्षक | code-projects Online Shop Store 1.0 Cross Site Scripting |
|---|
| विवरण | The Online Shop web application is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the signup.php page. The vulnerability arises because the application does not properly sanitize or escape user input from the m2 parameter before rendering it in the HTML response. This allows an attacker to inject arbitrary JavaScript into the page, which is executed in the context of the victim's browser when the vulnerable page is loaded.
Vulnerable Page
Page: signup.php
Vulnerable Parameter: m2
POC: http://localhost/online-shop/signup.php?m2=<svg onload=alert(document.cookie)>
Attack Type: Reflected Cross-Site Scripting (XSS)
Impact: Allows attackers to inject malicious JavaScript into the page that can execute on a victim's browser. This can lead to:
Session Hijacking: Stealing session cookies and impersonating the user.
Credential Theft: Attacker can capture user credentials if they are entered into malicious forms or alerts.
Phishing Attacks: Redirect victims to fake login pages or steal sensitive information.
Defacement: Alter the appearance or functionality of the page.
Risk Level: High, as this vulnerability can affect all users who visit the vulnerable page and interact with the m2 parameter. |
|---|
| स्रोत | ⚠️ https://github.com/sh3rl0ckpggp/0day/blob/main/code-projects_online-shop_CrossSiteScripting.md |
|---|
| उपयोगकर्ता | sh3rl0ckpgp (UID 77534) |
|---|
| सबमिशन | 12/11/2024 01:25 PM (2 साल पहले) |
|---|
| संयम | 15/11/2024 08:25 AM (3 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 284679 [code-projects Online Shop Store 1.0 /signup.php m2 क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|