| 제목 | Source Coder Facebook News Feed Like using PHP/MySQL with Source Code v1.0 XSS ( Cross site scripting in update profile) |
|---|
| 설명 | # Exploit Title: Facebook News Feed Like using PHP/MySQL with Source Code Stored XSS in "Update profile"
# Exploit Author: Ritik Dewan
# Vendor Name: oretnom23
# Vendor Homepage: https://www.sourcecodester.com/php/14602/facebook-news-feed-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/php/14602/facebook-news-feed-using-phpmysqli-source-code.html
# Version: v1.0
# Tested on: Windows 11, Apache
Description: A multiple stored XSS in update profile in Facebook News Feed Like using PHP/MySQL with Source Code v1.0 allows an attacker to input arbitrary JavaScript code into those vulnerable parameters.
Vulnerable Parameters:
First Name
Last Name
Payload:
<script>alert(1)</script>
Steps:
1)Create a new account.
2) Now enter the required details , after doing this your account has been created and you will redirected to dashboard.
3) Go to my profile now in parameters "First Name" and "Last Name" put your payload and save it.
Payload: <script>alert(1)</script>
4) Now save the user profile and our payload has been executed. |
|---|
| 사용자 | dewanritik (UID 33804) |
|---|
| 제출 | 2024. 01. 28. PM 03:45 (2 연령 ago) |
|---|
| 모더레이션 | 2024. 01. 29. PM 12:03 (20 hours later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 252292 [SourceCodester Facebook News Feed Like 1.0 New Account First Name/Last Name 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|