| शीर्षक | YAFNET XSS |
|---|
| विवरण | YAFNET version:3.1.9 and 3.1.10 is vulnerable to cross-site scripting. The vulnerability allows users to embed arbitrary JavaScript code in the Send Private Message page that alters the intended functionality, potentially leading to credential disclosure in trusted sessions.
affected source code file : https://github.com/YAFNET/YAFNET/blob/master/yafsrc/YetAnotherForum.NET/Pages/PostPrivateMessage.cshtml.cs (on web page : http://your-ip.com/forum/PostPrivateMessage)
Send a private message to the victim after entering the XSS payload into the subject and message fields.
Already commit the open source owner and submlit to https://github.com/YAFNET/YAFNET/security/advisories. |
|---|
| स्रोत | ⚠️ https://drive.google.com/drive/folders/1ct6Tp_cnsYO8L_JSvlBCf_Ae7KW3JAcD?usp=sharing |
|---|
| उपयोगकर्ता | lin7lic (UID 39301) |
|---|
| सबमिशन | 21/01/2023 07:42 AM (4 साल पहले) |
|---|
| संयम | 27/01/2023 07:57 PM (7 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 219665 [YAFNET तक 3.1.10 Private Message PostPrivateMessage subject/message क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 15 |
|---|