Persistent XSS #156
Description
The "utilisateur" menu on the WityCMS 0.6.2 site modifies the presence of XSS at two input points for user information, with the parameters "first name" and "last name".
payload:
" onclick="alert(document.cookie)"
" onclick="alert(document.cookie)"
Javascript gets executed. Here's an output of the mentioned payload when entered and saved.
Payload data are submitted to apps/user/admin/view.php
When users want to change their names, clicking the input box triggers the code.
