| タイトル | SOURCECODESTER FAQ Management System Using PHP and MySQL 1.0 Cross Site Scripting |
|---|
| 説明 | There is not input sanitization present when writing FAQs, making the web application vulnerable to XSS.
Allows XSS by placing untrusted code on the parameters question and answer.
Payload used is %3Cscript%3Ealert%28%27reigz+was+here%27%29%3C%2Fscript%3E for both parameters.
Affected endpoint in question is /faq-management-system/endpoint/add-faq.php
POC and further details available on github. |
|---|
| ソース | ⚠️ https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/SOURCECODESTER%20%5BFAQ%20Management%20System%20Using%20PHP%20and%20MySQL%5D%20XSS%20on%20add-faq.php.md |
|---|
| ユーザー | reiginald (UID 64219) |
|---|
| 送信 | 2024年02月29日 01:48 (3 年 ago) |
|---|
| モデレーション | 2024年03月01日 08:26 (1 day later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 255385 [SourceCodester FAQ Management System 1.0 /endpoint/add-faq.php question/answer クロスサイトスクリプティング] |
|---|
| ポイント | 19 |
|---|