vendor:
Simple Public Chat Room
by:
Richard Jones
8.8
CVSS
HIGH
Stored Cross-Site Scripting
79
CWE
Product Name: Simple Public Chat Room
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sourcecodester:simple_public_chat_room:1.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34
2021
Simple Public Chat Room 1.0 – ‘msg’ Stored Cross-Site Scripting
A stored cross-site scripting vulnerability exists in Simple Public Chat Room 1.0, which allows an attacker to inject malicious JavaScript code into the 'msg' parameter of the send_message.php page. This malicious code is then stored in the application and is executed when the page is loaded by other users, resulting in the execution of the malicious code in the context of the victim's browser.
Mitigation:
Input validation should be used to prevent the injection of malicious code into the application.
