564d2ddf47
13 changes to exploits/shellcodes/ghdb DSL-124 Wireless N300 ADSL2+ - Backup File Disclosure Uniview NVR301-04S2-P4 - Reflected Cross-Site Scripting (XSS) Book Store Management System 1.0.0 - Stored Cross-Site Scripting (XSS) Helmet Store Showroom v1.0 - SQL Injection Human Resource Management System 1.0 - SQL Injection (unauthenticated) Revenue Collection System v1.0 - Remote Code Execution (RCE) WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated) Outline V1.6.0 - Unquoted Service Path Inbit Messenger v4.9.0 - Unauthenticated Remote Command Execution (RCE) Inbit Messenger v4.9.0 - Unauthenticated Remote SEH Overflow Internet Download Manager v6.41 Build 3 - Remote Code Execution (RCE)
18 lines
No EOL
703 B
Text
18 lines
No EOL
703 B
Text
# Exploit Title: Book Store Management System 1.0.0 - Stored Cross-Site Scripting (XSS)
|
|
# Date: 2022-11-08
|
|
# Exploit Author: Rajeshwar Singh
|
|
# Vendor Homepage: https://www.sourcecodester.com/
|
|
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsms_ci.zip
|
|
# Tested on: Windows/XAMPP
|
|
###########################################################################
|
|
|
|
Payload use = "><script>alert("XSS")</script>
|
|
|
|
1. Visit URL http://localhost/bsms_ci/
|
|
2. login with admin Credentials
|
|
3. navigate to user Management
|
|
4. Click on "Add New System User"
|
|
5. Add payload in "Name" input field
|
|
6. Click save.
|
|
7. Visit http://localhost/bsms_ci/index.php/user
|
|
8. XSS payload execute. |