Security vulnerabilities

  • Status Closed
  • Assigned To No-one
  • Private
Attached to Project: Security vulnerabilities
Opened by sabeesh - 24.11.2024
Last edited by cbay - 25.11.2024

FS#102 - Reflective Xss

Hi Team i have found a reflective Xss in your url

http://phppgadmin.alwaysdata.com/phppgadmin/index.php?server=8890

when i use this payload it triggers alert

https://phppgadmin.alwaysdata.com/phppgadmin/index.php?server=%22{text%3a%3Cimg%2fsrc%3dx+onload%3dconfirm(1)%3E}%22

Please reach out to me , My email id is sabeesh.harinarayanan@gmail.com for POC as i am unable to attach here

Regards
Sabeesh

Closed by  cbay
25.11.2024 08:20
Reason for closing:  Invalid
25.11.2024: A request to reopen the task has been made.
sabeesh commented on 24.11.2024 16:19

disregard the last one

sabeesh commented on 24.11.2024 16:47

Hi I found 4 reflective xss on parameter server=

Hoping to hear from you soon

Admin
cbay commented on 25.11.2024 08:16

Hello,

We're running the latest version of phpPgAdmin. I suggest you report it to them.

Kind regards,
Cyril

sabeesh commented on 25.11.2024 12:34

HI Cyril
I am not sure why i have to report to them the domain is yours https://phppgadmin.alwaysdata.com/

and it is inscope

Admin
cbay commented on 25.11.2024 12:58
and it is inscope

No, please read the invalid reports section:

Reports about third-party applications we provide to our customers but aren’t part of our system directly (phpMyAdmin, Roundcube Webmail, etc.), if the vulnerability doesn’t directly exposes customers data and/or metadatas.
Reports on third-party applications that we provide to our customers but are not directly part of our system (phpMyAdmin, Webmail Roundcube, etc.), unless the vulnerability that exposes user data and/or metadata is fixed for more than a month in the upstream version and we are not up to date.

Loading...

Available keyboard shortcuts

Tasklist

Task Details

Task Editing