Vanilla Forum 2.6.3 Cross Site Scripting

2020.02.11

Credit: Sayak Naskar

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2020-8825

CWE: CWE-79

Ogólna skala CVSS: 3.5/10

Znaczenie: 2.9/10

Łatwość wykorzystania: 6.8/10

Wymagany dostęp: Zdalny

Złożoność ataku: Średnia

Autoryzacja: Jednorazowa

Wpływ na poufność: Brak

Wpływ na integralność: Częściowy

Wpływ na dostępność: Brak

# CVE-2020-8825
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8825
    
## Vendor:
    VanillaForum 

## Description:   
    It is possible to store xss payload in index.php?p=/dashboard/settings/branding. An attacker will store the xss payload on this section and when the user will visit the page then attacker will get all the sensitive information of the user.

## Environment:

    Version: 2.6.3
    OS: Windows 10, Linux
    PHP: 7
    URL: index.php?p=/dashboard/settings/branding
    
## Proof of Concept:
    https://github.com/hacky1997/CVE-2020-8825/blob/master/vanilla.png

## Assigned by:
  [Sayak Naskar](https://github.com/hacky1997/)
  

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Vanilla Forum 2.6.3 Cross Site Scripting

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.