vendor:
Colorful Blog
by:
Besim
8,8
CVSS
HIGH
Stored Cross Site Scripting
79
CWE
Product Name: Colorful Blog
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: PHP
2016
Colorful Blog – Stored Cross Site Scripting
A stored XSS vulnerability exists in Colorful Blog, which allows an attacker to inject malicious JavaScript code into the 'adsoyad' parameter of the 'single.php' page. By sending a crafted POST request with the malicious payload, an attacker can execute arbitrary JavaScript code in the victim's browser.
Mitigation:
Input validation should be used to prevent malicious code from being stored in the application. Additionally, the application should use a whitelist of accepted characters and reject any input that contains characters outside of the whitelist.
