XSS in markdown parsing in /create_poll.php
There was an XSS on the current version of the framadate.
Prerequisite: A local installation of framadate instance is needed.
Markdown Payload :
[Click Me](http://onclick=setTimeout`prompt\u0028document.domain\u0029`//)
Steps to reproduce:
- Visit https://localhost/create_poll.php?type=date
- Enter payload above.
- Click on the preview. Then click the text link.
- Javascript will execute.
Ps; Many websites are suffering with this XSS. I have reach you guys so It could be fixed really soon as It was suggested to me by those websites that are affected.
Hey,
- First of all, the website is running open source software that is developed by others, we are just using it. To have the biggest impact with your report, I suggest you notify the developers directly. Their website is at <https://framadate.org/>, their development is done here <https://framagit.org/framasoft/framadate>. This way, your report would be processed at the source of all installations.
Thanks again
I hope this could be fixed soon;
Best,