LFI to RCE via access_log injection

on
18

Cookie-Based Cross-Site Scripting (XSS)

on

This vulnerability counts as medium risk. All you need is install Cookies Manager+ addon in firefox or any other addon/plugin that use to manipulate cookie.

Browse the page as usual.


Open Cookies Manager+ and search for vulnerable cookie parameter, in this case is C_UL parameter. Double click on it and change the content with XSS payload and Save it.





 Back to the browser, refresh the page and you will see the pop-up.

Thats it! This kind of vulnerability worth 50-100 usd in bug bounty program. Happy hunting! :)

Comments

Gaurav said…
Effective Studying Habits
How to improve Childs Reading and writing Skills
India's Best CBSE, ICSE, State Boards School Syllabus mapped E Learning App for K-12 Students. This Learning App covers learning courses from Kindergarten to Class 12th which makes Concept Learning Effective and Easy Learning Experience.
February 26, 2021 at 7:38 PM
Max Roy said…
I get more information about Cookie-Based Cross-Site Scripting from your blog. Keep writing more blogs on tech. Now it's time to avail Average Home Insurance Rates in Texas by City for more information
March 9, 2023 at 6:46 PM
Riley Smith said…
This post providing information about Cookie-Based Cross-Site Scripting (XSS) is highly informative and important. Thank you for sharing this valuable information and raising awareness about the potential risks associated with cookie-based XSS. Read more about Professional Door Installation Services in Morganville for more information.
July 14, 2023 at 3:17 AM
Sandy Stefan said…
Understanding the risks of Cookie-Based Cross-Site Scripting (XSS) is vital for user data and protecting web applications. Keep sharing more updates with us. Now read more about preston to manchester airport taxi for more information.
July 21, 2023 at 6:31 PM
Areej Salam said…
Cookie-based cross-site scripting demonstrates how, if left unchecked, minor flaws can result in serious security threats. It highlights the necessity of cautious coding procedures and robust validation techniques. In a similar vein, professional academic proofreaders in Dubai guarantee correctness and precision in written work, assisting with the removal of mistakes and the clear and secure presentation of information.
April 28, 2026 at 5:37 PM
Chris Jhonson said…
"A valuable reminder of the importance of identifying and fixing security vulnerabilities to create safer digital experiences. Strong online solutions also require a professional physio website design service to build trust and connect healthcare providers with patients effectively."
June 16, 2026 at 7:03 PM
Jacob Martin said…
Thanks for sharing this overview of Cookie-Based XSS vulnerabilities. It's a useful reminder that client-side data, including cookies, should never be trusted without proper validation and output encoding. Security issues like these highlight the importance of secure coding practices, regular testing, and responsible disclosure through bug bounty programs. Great educational content for anyone interested in web application security.

Just as cybersecurity focuses on identifying root causes before problems escalate, a Functional health practitioner works to uncover underlying factors that may be affecting overall health and well-being.
June 18, 2026 at 5:51 PM
Post a Comment