| 标题 | Source Coder Facebook News Feed Like using PHP/MySQL with Source Code v1.0 XSS ( Cross site scripting in update profile) |
|---|
| 描述 | # Exploit Title: Facebook News Feed Like using PHP/MySQL with Source Code Stored XSS in "Update profile"
# Exploit Author: Ritik Dewan
# Vendor Name: oretnom23
# Vendor Homepage: https://www.sourcecodester.com/php/14602/facebook-news-feed-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/php/14602/facebook-news-feed-using-phpmysqli-source-code.html
# Version: v1.0
# Tested on: Windows 11, Apache
Description: A multiple stored XSS in update profile in Facebook News Feed Like using PHP/MySQL with Source Code v1.0 allows an attacker to input arbitrary JavaScript code into those vulnerable parameters.
Vulnerable Parameters:
First Name
Last Name
Payload:
<script>alert(1)</script>
Steps:
1)Create a new account.
2) Now enter the required details , after doing this your account has been created and you will redirected to dashboard.
3) Go to my profile now in parameters "First Name" and "Last Name" put your payload and save it.
Payload: <script>alert(1)</script>
4) Now save the user profile and our payload has been executed. |
|---|
| 用户 | dewanritik (UID 33804) |
|---|
| 提交 | 2024-01-28 15時45分 (2 年前) |
|---|
| 管理 | 2024-01-29 12時03分 (20 hours later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 252292 [SourceCodester Facebook News Feed Like 1.0 New Account First Name/Last Name 跨网站脚本] |
|---|
| 积分 | 17 |
|---|