Hello:
I have find a Reflected XSS vulnerability in admin.faq.php.
The vulnerability exists due to insufficient filtration of user-supplied data in "id" HTTP parameter that will be passed to "MaNGOSWebV4-master/inc/admin/template_files/admin. donate.php ". The infected source code is line 37, there is no protection on $_GET[‘id’]; if $_GET[‘id’] contains evil js code, line 37 will trigger untrusted code to be executed on the browser side.
Hello: I have find a Reflected XSS vulnerability in admin.faq.php.
The vulnerability exists due to insufficient filtration of user-supplied data in "id" HTTP parameter that will be passed to "MaNGOSWebV4-master/inc/admin/template_files/admin. donate.php ". The infected source code is line 37, there is no protection on $_GET[‘id’]; if $_GET[‘id’] contains evil js code, line 37 will trigger untrusted code to be executed on the browser side.
So if a attacker construct a special url as follow and send it to a victim, when the victim click the url, the code which is contained in the url will be executed on the victim's browser side to do some evil. http://your-web-root/MaNGOSWebV4-master/inc/admin/template_files/admin.donate.php?id="><"
The follow scrrenshot is the result to click the upper url ( win7 spq x64 + firefox 51.0.1 32bit ):
Discoverer: ADLab of Venustech