phpVibe versions prior to 4.20 suffer from a persistent cross site scripting vulnerability.
99a7c3ccb97289e5e90665ab5b974a718b5252267a0ac9fee73c005731d23314# phpVibe < 4.20 Stored XSS
# Vendor Homepage: http://www.phpvibe.com
# Affected Versions: prior to 4.20
# Discovered by Filippos Mastrogiannis
# Twitter: @filipposmastro
# LinkedIn: https://www.linkedin.com/pub/filippos-mastrogiannis/68/132/177
-- Description --
This stored XSS vulnerability allows any logged in user
to inject malicious code in the comments section:
e.g. "><body onLoad=confirm("XSS")>
The vulnerability exists because the user input is not properly sanitized
and this can lead to malicious code injection that will be executed on the
target’s browser
-- Proof of Concept --
1. The attacker posts a new comment which contains our payload:
"><body onLoad=confirm("XSS")>
2. The stored XSS can be triggered when any user visits the link of the
uploaded content
-- Solution --
The vendor has fixed the issue in the version 4.21
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed