Lucene search

aflog-xss.txt

🗓️ 25 Jul 2008 00:00:00Reported by DentrasiType

packetstorm🔗 packetstormsecurity.com👁 21 Views

Users' display names not sanitized, enabling XSS attacks. Affects user and online view

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

`//Author  
Dentrasi  
  
//Application  
Aflog  
  
//Version  
1.01  
  
//Site  
http://www.aflog.org  
  
//Bug  
Users' display names are not sanitized, allowing XSS attacks to be performed.  
  
//PoC  
When signing up, use the display name:  
<script>alert('xss')</script>  
This affects your name when viewing any page that you have posted a comment on.  
It also affects anyone viewing any page while you are online, as aflog prints a list of online users in the page footer.`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

25 Jul 2008 00:00Current

7.4High risk

Vulners AI Score7.4