___________________________________________________
|
| Exploit Title: web2Project cms Cross Site Scripting(XSS)
| Exploit Author: Ashiyane Digital security Team
| Vendor Homepage : https://web2project.net/
| Software Link: https://github.com/web2project/web2project/archive/version3.3.tar.gz
| Version: 3.3
| Date: 2017-11-06
| Category: Webapps
| Tested on: Kali-Linux /FireFox
|__________________________________________________
|
| Exploit :
|
|
|
|
|
|
|
|__________________________________________________
|
| Vulnerable method :
| $_GET
|
| Vulnerable File:
| http://TARGET/path/lib/PEAR/HTML/BBCodeParser/example/parser.php
|
| Vulnerable code:
|
| line 36 :
|
|__________________________________________________
|
| patch:
|
| For fix this vulnerability you use htmlspecialchars() function .
|__________________________________________________
|
| Discovered By : M.R.S.L.Y
|__________________________________________________