CVE-2019-18873

This exploit leverages stored XSS vulnerabilities in FUDForum 3.0.9 to achieve remote code execution by uploading a PHP shell. The attack involves injecting malicious JavaScript via username or user-agent fields, which executes when an admin views user information.

This repository contains a functional exploit for CVE-2019-18873 and CVE-2019-18839, targeting FUDForum 3.0.9. The exploit leverages stored XSS vulnerabilities in the username and User-Agent fields to achieve remote code execution by uploading a PHP shell.

This repository contains a functional exploit for CVE-2019-18873 and CVE-2019-18839, demonstrating stored XSS vulnerabilities in FUDForum 3.0.9 that can lead to remote code execution. The exploit includes detailed steps and a JavaScript payload (fud.js) that, when triggered by an admin, uploads a PHP shell to the target system.