Advanced Comment System 1.0 Cross Site Scripting

Advanced Comment System version 1.0 suffers from a cross site scripting vulnerability.

MD5 | 48602f1584c84c8d0e29a07d999f9915

# Exploit Title: Cross Site Scripting in Advanced comment system v1.0
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage:
# Software Link:,
# Version: Advanced comment system v1.0
# Tested on: All
# CVE : CVE-2018-18845
# Category: webapps

1. Description

Advanced Comment System, version 1.0, the page
internal/advanced_comment_system/index.php contains a reflected cross-site
scripting vulnerability. A remote unauthenticated attacker could
potentially exploit this vulnerability to supply malicious HTML or
JavaScript code to a vulnerable web application, which is then reflected
back to the victim and executed by the web browser. The product is

2. Proof of Concept


3. Solution:

The product is discontinued.


Related Posts