Auditor Website 2.0.1 Cross-Site Scripting

2018.08.03
Risk: Low
Local: No
Remote: Yes
CWE: N/A

******************************************************************************************* # Exploit Title: Chartered Accountant : Auditor Website 2.0.1 - Reflected , Stored XSS # Date: 26.06.2018 # Site Titel : Find your needs on Domain Name # Vendor Homepage: https://www.phpscriptsmall.com/ # Software Link: https://www.phpscriptsmall.com/product/cms-auditor-website/ # Category: Web Application # Version: 2.0.1 # Exploit Author: Vikas Chaudhary # Contact: https://www.facebook.com/profile.php?id=100011287630308 # Web: https://gkaim.com/ # Tested on: Windows 10 -Firefox # CVE: CVE-2018-13256 ***************************************************************************************** Proof of Concept:- -------------------------- 1. Go to the site ( http://server/auditor/ ) . 2- Select REGISTER page (Register now) . 3- Create an account using your Email address => in FIRST NAME , LAST NAME ,and PASSWORD put this script <img src =x onError=alert("VIKAS")> 4- Now Check your Email and verify it . 5- Again come to site and login it using your verified Email and Password . 6- You will having popup VIKAS in you account when you loged in . ***************************************************************************************


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top