| タイトル | Source Coder Facebook News Feed Like using PHP/MySQL with Source Code v1.0 XSS ( Cross site scripting in update profile) |
|---|
| 説明 | # Exploit Title: Facebook News Feed Like using PHP/MySQL with Source Code Stored XSS in "Update profile"
# Exploit Author: Ritik Dewan
# Vendor Name: oretnom23
# Vendor Homepage: https://www.sourcecodester.com/php/14602/facebook-news-feed-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/php/14602/facebook-news-feed-using-phpmysqli-source-code.html
# Version: v1.0
# Tested on: Windows 11, Apache
Description: A multiple stored XSS in update profile in Facebook News Feed Like using PHP/MySQL with Source Code v1.0 allows an attacker to input arbitrary JavaScript code into those vulnerable parameters.
Vulnerable Parameters:
First Name
Last Name
Payload:
<script>alert(1)</script>
Steps:
1)Create a new account.
2) Now enter the required details , after doing this your account has been created and you will redirected to dashboard.
3) Go to my profile now in parameters "First Name" and "Last Name" put your payload and save it.
Payload: <script>alert(1)</script>
4) Now save the user profile and our payload has been executed. |
|---|
| ユーザー | dewanritik (UID 33804) |
|---|
| 送信 | 2024年01月28日 15:45 (2 年 ago) |
|---|
| モデレーション | 2024年01月29日 12:03 (20 hours later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 252292 [SourceCodester Facebook News Feed Like 1.0 New Account First Name/Last Name クロスサイトスクリプティング] |
|---|
| ポイント | 17 |
|---|