Aflog version 1.01 suffers from a cross site scripting vulnerability.
7a0740e91d1db14ae397cf034a2dc5d06bfea1555846afbca6f657eb40cd50c5//Author
Dentrasi
//Application
Aflog
//Version
1.01
//Site
https://www.aflog.org
//Bug
Users' display names are not sanitized, allowing XSS attacks to be performed.
//PoC
When signing up, use the display name:
<script>alert('xss')</script>
This affects your name when viewing any page that you have posted a comment on.
It also affects anyone viewing any page while you are online, as aflog prints a list of online users in the page footer.
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed