Advertisement




Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2022070007

Below is a copy:

Paymoney 3.3 Cross Site Scripting
## Title: paymoney-3.3 XSS-Reflected
## Author: nu11secur1ty
## Date: 07.02.2022
## Vendor: https://paymoney.techvill.org/
## Software: paymoney-3.3
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/paymoney/2022/paymoney-3.3

Description:
The parameters first_name and last_name in Users are vulnerable from
XSS-Reflected on Paymoney-3.3. The already authenticated users can be
hijacking the XSRF-Token and they can use it for malicious purposes on
internal and external domains.

STATUS: Medium

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/paymoney/2022/paymoney-3.3)

## Proof and Exploit:
[href](https://streamable.com/fhzvyr)


Copyright ©2022 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.