You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Severity: HighDiscovered: 17 of December-2023, 08:08 PM UTC
CWE ID
CWE-79
CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Details
This attack inserted malicious input into a vulnerable element. This data element is shown below in the Additional Information section.
The attack inserted the value <script>alert("bright433535");</script> and used the action Clicking the element or moving the mouse over it to produce 'onmouseover' action..
This caused the target to execute an alert function with the value: bright433535 that verified whether the JavaScript injection was successful.
Both reflected and stored XSS can be addressed by performing the appropriate validation and escaping on the server-side. DOM Based XSS can be addressed with a special subset of rules a more in-depth and detailed reading is suggested in the reference section
Request
GET http://brokencrystals.com/#faq-list-0 HTTP/1.1Referer: http://brokencrystals.com/accept-charset:accept: aaa Cookie: bc-calls-counter=1702840725456; connect.sid=rduvlQ3Yusci0Qrkm5cjiLcsOFCCIlze.va4R41n%2FPijzH5%2BWEWqeeolxF%2FFFqoPfV%2FVDumX%2Bj3cUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/106.0.5249.119 Safari/537.36Accept-Encoding: identityContent-Length: 0
Cross-Site Scripting
Severity:
HighDiscovered:17 of December-2023, 08:08 PM UTCCWE ID
CWE-79
CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Details
This attack inserted malicious input into a vulnerable element. This data element is shown below in the Additional Information section.
The attack inserted the value <script>alert("bright433535");</script> and used the action Clicking the element or moving the mouse over it to produce 'onmouseover' action..
This caused the target to execute an alert function with the value: bright433535 that verified whether the JavaScript injection was successful.
Possible exposure
Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data; Website Defacement
Remediation suggestions
Both reflected and stored XSS can be addressed by performing the appropriate validation and escaping on the server-side. DOM Based XSS can be addressed with a special subset of rules a more in-depth and detailed reading is suggested in the reference section
Request
Response
Screenshots
External links
The text was updated successfully, but these errors were encountered: