| Title | Source Coder Facebook News Feed Like using PHP/MySQL with Source Code v1.0 XSS ( Cross site scripting in update profile) |
|---|
| Description | # Exploit Title: Facebook News Feed Like using PHP/MySQL with Source Code Stored XSS in "Update profile"
# Exploit Author: Ritik Dewan
# Vendor Name: oretnom23
# Vendor Homepage: https://www.sourcecodester.com/php/14602/facebook-news-feed-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/php/14602/facebook-news-feed-using-phpmysqli-source-code.html
# Version: v1.0
# Tested on: Windows 11, Apache
Description: A multiple stored XSS in update profile in Facebook News Feed Like using PHP/MySQL with Source Code v1.0 allows an attacker to input arbitrary JavaScript code into those vulnerable parameters.
Vulnerable Parameters:
First Name
Last Name
Payload:
<script>alert(1)</script>
Steps:
1)Create a new account.
2) Now enter the required details , after doing this your account has been created and you will redirected to dashboard.
3) Go to my profile now in parameters "First Name" and "Last Name" put your payload and save it.
Payload: <script>alert(1)</script>
4) Now save the user profile and our payload has been executed. |
|---|
| User | dewanritik (UID 33804) |
|---|
| Submission | 01/28/2024 15:45 (2 years ago) |
|---|
| Moderation | 01/29/2024 12:03 (20 hours later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 252292 [SourceCodester Facebook News Feed Like 1.0 New Account First Name/Last Name cross site scripting] |
|---|
| Points | 17 |
|---|