FUDForum 3.1.0 - 'srch' Reflected XSS

Author: Piyush Patil
type: webapps
platform: php
port: 
date_added: 2021-06-03  
date_updated: 2021-06-03  
verified: 0  
codes: CVE-2021-27519  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comFUDforum_3.1.0.zip  

raw file: 49942.txt  

# Exploit Title: FUDForum 3.1.0 - 'srch' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: http://fudforum.org/
# Software Link: https://sourceforge.net/projects/fudforum/files/FUDforum_3.1.0.zip/download
# Version: FUDForum 3.1.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27519

-Description:
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.


-Payload used:
x" onmouseover=alert(1) x="

-Steps to reproduce:
1- goto https://localhost/fudforum/index.php?t=search&
2- In "forum search" option, paste XSS payload
3- Hover your mouse to "x" and XSS will get triggered