header-logo
Suggest Exploit
vendor:
Discuz!
by:
Unknown
7.5
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: Discuz!
Affected Version From: Discuz! 6.0.0
Affected Version To: Unknown
Patch Exists: NO
Related CWE: Not specified
CPE: a:discuz_project:discuz
Metasploit:
Other Scripts:
Platforms Tested: Unknown
Unknown

Cross-Site Scripting Vulnerability in Discuz!

The Discuz! application fails to properly sanitize user-supplied input, leading to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execute arbitrary script code in the browser of an unsuspecting user, potentially stealing authentication credentials and launching further attacks.

Mitigation:

Apply appropriate input validation and encoding techniques to prevent script injection attacks. Regularly update to the latest version of Discuz! to ensure security patches are applied.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/37982/info

Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Discuz! 6.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/bbs/viewthread.php?tid=">><script>alert(HACKED BY FATAL ERROR)</script><marquee><h1>XSS By Fatal Error</h1></marquee>

Navigation

Suggest Exploit

Services By CQR