FUDForum 3.1.0 - 'author' Reflected XSS

vendor:

FUDForum

by:

Piyush Patil

6.1

CVSS

MEDIUM

Reflected XSS

CWE

Product Name: FUDForum

Affected Version From: 3.1.0

Affected Version To: 3.1.0

Patch Exists: YES

Related CWE: CVE-2021-27520

CPE: a:fudforum:fudforum:3.1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10, Kali

2021

FUDForum 3.1.0 – ‘author’ Reflected XSS

A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the 'author' parameter.

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: FUDForum 3.1.0 - 'author' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: http://fudforum.org/
# Software Link: https://sourceforge.net/projects/fudforum/files/FUDforum_3.1.0.zip/download
# Version: FUDForum 3.1.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27520

-Description:
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.


-Payload used:
y" onmouseover=alert(2) y="

-Steps to reproduce:
1- goto https://localhost/fudforum/index.php?t=search&
2- In the "Filter by User" search option, paste XSS payload
3- Hover your mouse to "y" and XSS will get triggered