FUDforum-XSS-RCE

FUDforum-XSS-RCE FUDForum 3.0.9 - XSS / Esecuzione di codice remoto CVE-2019-18873, CVE-2019-18839 Sono state trovate multiple vulnerabilità XSS persistenti in FUDforum 3.0.9 che possono portare a esecuzione di codice remoto. XSS persistente tramite nome utente nel forum: Informazioni |...

CVE-2019-18839

CVE-2019-18839 affects FUDForum 3.0.9. The vulnerability is a Stored XSS through the nlogin parameter, which can lead to remote code execution. An attacker can abuse a normal user account to fully compromise the system by sending a POST request; when an admin views the user information, the paylo...

CVE-2019-18839

FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin parameter. This may result in remote code execution. An attacker can use a user account to fully compromise the system using a POST request. When the admin visits the user information, the payload will execute. This will allow for PHP file...

CVE-2019-18873

FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...

CVE-2019-18873

FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...