XSS in markdown parsing in /create_poll.php
There was an XSS on the current version of the framadate.
Prerequisite: A local installation of framadate instance is needed.
Markdown Payload :
Steps to reproduce:
- Visit https://localhost/create_poll.php?type=date
- Enter payload above.
- Click on the preview. Then click the text link.
Ps; Many websites are suffering with this XSS. I have reach you guys so It could be fixed really soon as It was suggested to me by those websites that are affected.
Hey, - First of all, the website is running open source software that is developed by others, we are just using it. To have the biggest impact with your report, I suggest you notify the developers directly. Their website is at <https://framadate.org/>, their development is done here <https://framagit.org/framasoft/framadate>. This way, your report would be processed at the source of all installations. Thanks again
I hope this could be fixed soon;