Aflog version 1.01 suffers from a cross site scripting vulnerability.
779983379703d1acce929f110f56cdb1//Author
Dentrasi
//Application
Aflog
//Version
1.01
//Site
http://www.aflog.org
//Bug
Users' display names are not sanitized, allowing XSS attacks to be performed.
//PoC
When signing up, use the display name:
<script>alert('xss')</script>
This affects your name when viewing any page that you have posted a comment on.
It also affects anyone viewing any page while you are online, as aflog prints a list of online users in the page footer.
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!