5aa3bfc759
12 changes to exploits/shellcodes Comtrend AR-5387un router - Persistent XSS (Authenticated) Loan Management System 1.0 - Multiple Cross Site Scripting (Stored) Wordpress Plugin WP Courses < 2.0.29 - Broken Access Controls leading to Courses Content Disclosure Visitor Management System in PHP 1.0 - SQL Injection (Authenticated) Ultimate Project Manager CRM PRO Version 2.0.5 - SQLi (Authenticated) WordPress Plugin HS Brand Logo Slider 2.1 - 'logoupload' File Upload User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS RiteCMS 2.2.1 - Remote Code Execution (Authenticated) Mobile Shop System v1.0 - SQL Injection Authentication Bypass Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution WordPress Plugin Rest Google Maps < 7.11.18 - SQL Injection WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting (Authenticated)
27 lines
No EOL
1.1 KiB
Text
27 lines
No EOL
1.1 KiB
Text
# Exploit Title: User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS
|
|
# Google Dork: N/A
|
|
# Date: 2020-08-07
|
|
# Exploit Author: yusufmalikul
|
|
# Vendor Homepage: https://phpgurukul.com
|
|
# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
|
|
# Version: 2.1
|
|
# Tested on: Windows 10
|
|
# CVE : N/A
|
|
|
|
Description
|
|
|
|
User Registration & Login and User Management System With admin panel 2.1 application from PHPgurukul is vulnerable to
|
|
Persistent XSS via the fname, lname, email, and contact field name when user register on the site then admin viewing user
|
|
list on manage user page triggering the payload.
|
|
|
|
POC
|
|
|
|
User side
|
|
1. Go to the user registration page http://localhost/loginsystem
|
|
2. Enter <img src="x" onerror=alert(document.cookie)> in one of the field (first name, last name, email, or contact)
|
|
3. Click sign up
|
|
|
|
Admin side
|
|
1. Login to admin panel http://localhost/loginsystem/admin
|
|
2. After login successful it will redirect to manage user page
|
|
3. Payload triggered |