Description
Click2Magic 1.1.5 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts in the chat name input. Attackers can craft a malicious payload in the chat name to capture administrator cookies when the admin processes user requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Click2Magic | Click2Magic | ≤ 1.1.5 | — |
References
- ExploitDB-49347 exploit
- Vendor Homepage product
- Official Product Website product
- VulnCheck Advisory: Click2Magic 1.1.5 - Stored Cross-Site Scripting third-party-advisory