Ian Dunn · Report #172606
Google Authenticator - Cross Site Scripting
N/Astatus
1upvotes
11 Oct 2016disclosed
How it was found
Hello
#Vulnerable File: :
/views/token-prompt.php
#Vulnerable Link :
15
<input type="hidden" name="gapup_login_nonce" value="<?php echo esc_attr( $_REQUEST['gapup_login_nonce'] ) ?>" />
Vulnerable Code:
<?php echo esc_attr( $_REQUEST['gapup_login_nonce'] ) ?>
Good Luck/