Forminator Forms Pre-Auth DOM-Based XSS Vulnerability (CVSS 7.2) with POC

Vulnerability Overview Vulnerability Name: Forminator Forms < 1.17.2 - Unauthenticated DOM-Based Cross-Site Scripting Vulnerability Type: DOM Based Cross-Site Scripting (XSS) Affected Versions: Forminator Forms 1.17.2 and earlier CVSS Score: 7.2 Publication Date: January 14, 2021 Description: This vulnerability allows an unauthenticated attacker to execute malicious JavaScript code by manipulating URL parameters, resulting in a cross-site scripting attack. Impact Scope Affected Plugin: Forminator Forms Affected Versions: 1.17.2 and earlier Vulnerability Details: - Vulnerability Type: DOM Based XSS - Vulnerability Location: Form submission page - Vulnerable Parameter: - Exploitation: Attackers can inject malicious JavaScript code into the form submission page by constructing a malicious URL, which is then executed in the user's browser. Remediation Fixed Version: Forminator Forms 1.17.3 and later Remediation Measures: - Strictly validate and filter input data to prevent malicious code injection. - Use output encoding techniques to ensure that user input data is not interpreted as executable code when output. POC Code Additional Information Related Vulnerabilities: The page lists several other vulnerabilities related to Forminator Forms, including SQL injection and file inclusion issues. Reference Links: Provides multiple reference links, including vulnerability details and remediation advice. Summary Forminator Forms 1.17.2 and earlier versions contain an unauthenticated DOM-based cross-site scripting vulnerability. Attackers can execute malicious JavaScript code by constructing malicious URLs. It is recommended to upgrade to version 1.17.3 or later to fix this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Forminator Forms Pre-Auth DOM-Based XSS Vulnerability (CVSS 7.2) with POC

More from this source