cae82bb178
8 changes to exploits/shellcodes User Management System 2.0 - Persistent Cross-Site Scripting User Management System 2.0 - Authentication Bypass Complaint Management System 4.2 - Persistent Cross-Site Scripting Complaint Management System 4.2 - Authentication Bypass Complaint Management System 4.2 - Cross-Site Request Forgery (Delete User) Zen Load Balancer 3.10.1 - Directory Traversal (Metasploit) Sky File 2.1.0 iOS - Directory Traversal
42 lines
No EOL
1.2 KiB
Text
42 lines
No EOL
1.2 KiB
Text
# Exploit Title: Complaint Management System 4.2 - Persistent Cross-Site Scripting
|
|
# Author: Besim ALTINOK
|
|
# Vendor Homepage: https://phpgurukul.com/
|
|
# Software Link: https://phpgurukul.com/complaint-management-sytem/
|
|
# Version: v4.2
|
|
# Tested on: Xampp
|
|
# Credit: İsmail BOZKURT
|
|
|
|
------ Details:
|
|
|
|
1- Vulnerable code is here: http://localhost/cms/users/registration.php
|
|
2- Vulnerable code:
|
|
|
|
Insert user registration information to the DB without filtering.
|
|
|
|
if(isset($_POST['submit']))
|
|
{
|
|
$fullname=$_POST['fullname'];
|
|
$email=$_POST['email'];
|
|
$password=md5($_POST['password']);
|
|
$contactno=$_POST['contactno'];
|
|
$status=1;
|
|
$query=mysqli_query($con,"insert into
|
|
users(fullName,userEmail,password,contactNo,status)
|
|
values('$fullname','$email','$password','$contactno','$status')");
|
|
$msg="Registration successfull. Now You can login !";
|
|
}
|
|
?>
|
|
|
|
3- In the admin dashboard:
|
|
|
|
Get fullName from DB and print it without any filtering
|
|
|
|
<tr>
|
|
<td colspan="2"><b><?php echo $row['fullName'];?>'s profile</b></td>
|
|
</tr>
|
|
|
|
4- If we insert "fullName" as "script>prompt(2)</script>", we can perform
|
|
this attack as "Stored XSS"
|
|
|
|
5- Picture in the Attachemnt
|
|
--------------------------------------------------- |