livehelperchat

Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Telegram Bot Username Date: 09/06/2025 Exploit Author: Manojkumar J (TheWhiteEvil) Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/ Software Link: https://github.com/LiveHelperChat/livehelperchat/ Version: Live Help Configuration > Telegram Bot. 3. In the Bot Username field, enter the following payload: ` "> `` 4. Save the settings. 5. Revisit the Telegram configuration panel and — the payload will execute.

Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Facebook Integration Page Name Field Date: 09/06/2025 Exploit Author: Manojkumar J (TheWhiteEvil) Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/ Software Link: https://github.com/LiveHelperChat/livehelperchat/ Version: ``` 4. Save the changes. 5. The payload is stored and executed when higher-privileged users (e.g., operator or administrators) access or edit the Facebook page integration, resulting in stored Cross Site Scripting (XSS).

Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Operator Surname Date: 09/06/2025 Exploit Author: Manojkumar J (TheWhiteEvil) Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/ Software Link: https://github.com/LiveHelperChat/livehelperchat/ Version: ``` 4. Save the changes. 5. This payload is stored and later executed when an admin or higher-privileged user views the Recipients List where the attacker is listed as the Owner.

Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Personal Canned Messages Date: 09/06/2025 Exploit Author: Manojkumar J (TheWhiteEvil) Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/ Software Link: https://github.com/LiveHelperChat/livehelperchat/ Version: ``` 4. Save the changes. 5. Try to use the personal canned message, the cross site scripting (xss) will execute.

Exploit Title: LiveHelperChat ``` 4. Save the changes. 5. Revist the Department Assignment settings page and edit the Alias Nick field, the cross site scripting (xss) will execute.

Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via the Chat Transfer Function Date: 09/06/2025 Exploit Author: Manojkumar J (TheWhiteEvil) Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/ Software Link: https://github.com/LiveHelperChat/livehelperchat/ Version: ``` 4. Save the changes. 5. Initiate a chat with a visitor. 6. Transfer the chat to another operator — the XSS payload executes in the receiving operator’s chat interface.