vendor:
Vanilla Version 2.0.18.4 + Vanilla kPoll 1.2
by:
Henry Hoggard
8,8
CVSS
HIGH
Stored XSS
79
CWE
Product Name: Vanilla Version 2.0.18.4 + Vanilla kPoll 1.2
Affected Version From: Vanilla Version 2.0.18.4 + Vanilla kPoll 1.2
Affected Version To: Vanilla Version 2.0.18.4 + Vanilla kPoll 1.2
Patch Exists: YES
Related CWE: N/A
CPE: Vanillaforums.org/download
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2012
Vanilla kPoll 1.2 Stored XSS
Vanilla kPoll 1.2 is vulnerable to stored XSS. An attacker can inject malicious JavaScript code into the poll title field, which is then stored in the database and executed when the poll is viewed. The XSS I used is <script>alert('xss')</script>
Mitigation:
Input validation should be used to prevent malicious code from being stored in the database.
