12 lines
No EOL
586 B
Text
12 lines
No EOL
586 B
Text
# Exploit Title: Resumes Management and Job Application Website 1.0 - Multiple Stored XSS
|
|
# Date: 2/1/2021
|
|
# Exploit Author: Saswat Subhajyoti Mallick
|
|
# Vendor Homepage: https://egavilanmedia.com/
|
|
# Software Link: https://egavilanmedia.com/resumes-management-and-job-application-website/
|
|
# Version: 1.0
|
|
# Tested on: windows 10/wamp
|
|
|
|
Attacker can put stored xss and gain admin access unauthenticated .
|
|
For stored XSS poc simply put <script>alert(1)</script> in first name,last name and address field while applying for resume.
|
|
|
|
Stored XSS will be activated the moment admin user logs in. |