Codoforum software patched against stored XSS vulnerability

guest · Jan 13, 2020

Codoforum software patched against stored XSS vulnerability
January 13, 2020
https://portswigger.net/daily-swig/codoforum-software-patched-against-stored-xss-vulnerability

Codoforum, the PHP forum software used by thousands of websites, has been patched against a stored cross-site scripting (XSS) vulnerability that could lead to admin accounts being compromised.

Left unpatched, the flaw could allow an attacker to inject an XSS payload into a forum’s user registration page, according to security researchers ‘Prasanth c41m’ and Vyshnav Vizz, who discovered the issue.
Commercial Codoforum customers can rest easy, developer Codologic told The Daily Swig, since “their version isn’t affected by the same vulnerability due to an additional security plugin”.

The researchers have posted further technical details on Medium.
Click to expand...

Sampei Nihira · Jan 13, 2020

Wilderssecurity.com also has a Content Security Policy (CSP) header not implemented:

https://webbkoll.dataskydd.net/en/results?url=https://www.wilderssecurity.com/

Log in or Sign up

Codoforum software patched against stored XSS vulnerability

guest Guest

Sampei Nihira Registered Member

Log in or Sign up

Codoforum software patched against stored XSS vulnerability

guest Guest

Sampei Nihira Registered Member

Useful Searches