Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No Input Filtering for Discord #80

Open
0xEmma opened this issue Jun 6, 2021 · 0 comments
Open

No Input Filtering for Discord #80

0xEmma opened this issue Jun 6, 2021 · 0 comments

Comments

@0xEmma
Copy link

0xEmma commented Jun 6, 2021

Describe the bug
When using the discord integration, using [prefix]rv will display the 10 most recent visited pages. if you send a crafted payload, you can do things like ping everyone.

To Reproduce
Steps to reproduce the behavior:

  1. curl https://[DOMAIN]/```@everyone - ``` breaks out of the code block, @everyone is just a PoC ping
  2. run [prefix]rv
  3. See injectionon

Expected behavior
Strip or Escaped characters so that this can't happen

ShareS Version
4.5.3

Screenshots

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant