19 lines
No EOL
692 B
Text
19 lines
No EOL
692 B
Text
# Exploit Title: FUDForum 3.1.0 - 'author' Reflected XSS
|
|
# Exploit Author: Piyush Patil
|
|
# Vendor Homepage: http://fudforum.org/
|
|
# Software Link: https://sourceforge.net/projects/fudforum/files/FUDforum_3.1.0.zip/download
|
|
# Version: FUDForum 3.1.0
|
|
# Tested on: Windows 10 and Kali
|
|
# CVE : CVE-2021-27520
|
|
|
|
-Description:
|
|
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.
|
|
|
|
|
|
-Payload used:
|
|
y" onmouseover=alert(2) y="
|
|
|
|
-Steps to reproduce:
|
|
1- goto https://localhost/fudforum/index.php?t=search&
|
|
2- In the "Filter by User" search option, paste XSS payload
|
|
3- Hover your mouse to "y" and XSS will get triggered |