CVE-2019-19908

MEDIUMNuclei

phpMyChat-Plus 1.98 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-19908 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.php is vulnerable.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMphpMyChat-Plus 1.98 - Cross-Site ScriptingCVSS 6.1

phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmc_username parameter of pass_reset.php in password reset URL.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to a patched version of phpMyChat-Plus or apply the necessary security patches to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsmadrobot
Template tagscve2019cvephpMyChatxssciprianmpvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:ciprianmp:phpmychat-plus:1.98:*:*:*:*:*:*:*
Google: inurl:"/plus/pass_reset.php"
https://cinzinga.github.io/CVE-2019-19908/ http://ciprianmp.com/ https://sourceforge.net/projects/phpmychat/ https://nvd.nist.gov/vuln/detail/CVE-2019-19908 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

4