Affiliate Pro Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Affiliate Pro version 1.7. This vulnerability exists within the index module, where input fields for fullname, username, and email can be exploited. Attackers can inject malicious scripts through these parameters, leading to client-side attacks and manipulation of browser requests.

Impact

Exploitation of this vulnerability allows for session hijacking, phishing attacks, external redirects to malicious sites, and manipulation of application modules.

Reproduction

To reproduce this vulnerability, send a POST request to the index module with injected script payloads in the fullname, username, and email fields. The injected scripts will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.