{"id": "1337DAY-ID-29752", "type": "zdt", "bulletinFamily": "exploit", "title": "Facebook Clone Script 1.0.5 - Cross-Site Scripting Vulnerability", "description": "Exploit for php platform in category web applications", "published": "2018-02-10T00:00:00", "modified": "2018-02-10T00:00:00", "cvss": {"vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:NONE/I:PARTIAL/A:NONE/", "score": 3.5}, "cvss2": {}, "cvss3": {}, "href": "https://0day.today/exploit/description/29752", "reporter": "Prasenjit Kanti Paul", "references": [], "cvelist": ["CVE-2018-6858"], "immutableFields": [], "lastseen": "2018-04-04T03:41:39", "viewCount": 7, "enchantments": {"score": {"value": 5.1, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2018-6858"]}, {"type": "exploitdb", "idList": ["EDB-ID:44010"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:146329"]}], "rev": 4}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2018-6858"]}, {"type": "exploitdb", "idList": ["EDB-ID:44010"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:146329"]}]}, "exploitation": null, "vulnersScore": 5.1}, "sourceHref": "https://0day.today/exploit/29752", "sourceData": "######################################################################################\r\n# Exploit Title: Facebook Clone Script 1.0.5 - Stored XSS\r\n# Vendor Homepage: https://www.phpscriptsmall.com/\r\n# Software Link: https://www.phpscriptsmall.com/product/naukri-clone-script/\r\n# Category: Web Application\r\n# Exploit Author: Prasenjit Kanti Paul\r\n# Web: http://hack2rule.wordpress.com/\r\n# Version: 1.0.5\r\n# Tested on: Linux Mint\r\n# CVE: CVE-2018-6858\r\n#######################################################################################\r\n \r\nProof of Concept\r\n=================\r\n1. Login as a user\r\n2. Goto \"Comment\" option of any post\r\n3. Put \"<script>alert(\"PKP\")</script>\" as comment\r\n4. You will be having a popup \"PKP\"\n\n# 0day.today [2018-04-04] #", "_state": {"dependencies": 1645386103}}

{"packetstorm": [{"lastseen": "2018-02-15T00:22:34", "description": "", "published": "2018-02-09T00:00:00", "type": "packetstorm", "title": "Facebook Clone Script 1.0.5 Cross Site Scripting", "bulletinFamily": "exploit", "cvelist": ["CVE-2018-6858"], "modified": "2018-02-09T00:00:00", "id": "PACKETSTORM:146329", "href": "https://packetstormsecurity.com/files/146329/Facebook-Clone-Script-1.0.5-Cross-Site-Scripting.html", "sourceData": "`###################################################################################### \n# Exploit Title: Facebook Clone Script 1.0.5 - Stored XSS \n# Date: 07.02.2018 \n# Vendor Homepage: https://www.phpscriptsmall.com/ \n# Software Link: https://www.phpscriptsmall.com/product/naukri-clone-script/ \n# Category: Web Application \n# Exploit Author: Prasenjit Kanti Paul \n# Web: http://hack2rule.wordpress.com/ \n# Version: 1.0.5 \n# Tested on: Linux Mint \n# CVE: CVE-2018-6858 \n####################################################################################### \n \nProof of Concept \n================= \n1. Login as a user \n2. Goto \"Comment\" option of any post \n3. Put \"<script>alert(\"PKP\")</script>\" as comment \n4. You will be having a popup \"PKP\" \n \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/146329/facebookclone105-xss.txt"}], "exploitdb": [{"lastseen": "2018-02-10T14:54:07", "description": "Facebook Clone Script 1.0.5 - Cross-Site Scripting. CVE-2018-6858. Webapps exploit for PHP platform", "edition": 2, "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 5.4, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 2.7}, "published": "2018-02-10T00:00:00", "type": "exploitdb", "title": "Facebook Clone Script 1.0.5 - Cross-Site Scripting", "bulletinFamily": "exploit", "cvss2": {"severity": "LOW", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 3.5, "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6858"], "modified": "2018-02-10T00:00:00", "id": "EDB-ID:44010", "href": "https://www.exploit-db.com/exploits/44010/", "sourceData": "######################################################################################\r\n# Exploit Title: Facebook Clone Script 1.0.5 - Stored XSS\r\n# Date: 07.02.2018\r\n# Vendor Homepage: https://www.phpscriptsmall.com/\r\n# Software Link: https://www.phpscriptsmall.com/product/naukri-clone-script/\r\n# Category: Web Application\r\n# Exploit Author: Prasenjit Kanti Paul\r\n# Web: http://hack2rule.wordpress.com/\r\n# Version: 1.0.5\r\n# Tested on: Linux Mint\r\n# CVE: CVE-2018-6858\r\n#######################################################################################\r\n\r\nProof of Concept\r\n=================\r\n1. Login as a user\r\n2. Goto \"Comment\" option of any post\r\n3. Put \"<script>alert(\"PKP\")</script>\" as comment\r\n4. You will be having a popup \"PKP\"", "sourceHref": "https://www.exploit-db.com/download/44010/", "cvss": {"score": 0.0, "vector": "NONE"}}], "cve": [{"lastseen": "2022-03-23T18:29:28", "description": "Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-02-12T03:29:00", "type": "cve", "title": "CVE-2018-6858", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 3.5, "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6858"], "modified": "2020-03-11T15:49:00", "cpe": ["cpe:/a:facebook_clone_script_project:facebook_clone_script:1.0.5"], "id": "CVE-2018-6858", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6858", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:facebook_clone_script_project:facebook_clone_script:1.0.5:*:*:*:*:*:*:*"]}]}