Complaint Management System 4.2 – Persistent Cross-Site Scripting

• Exploit Database
• 16 阅读

• 作者： Besim
  日期： 2020-04-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48370/

• # Exploit Title: Complaint Management System 4.2 - Persistent Cross-Site Scripting
  # Author: Besim ALTINOK
  # Vendor Homepage: https://phpgurukul.com/
  # Software Link: https://phpgurukul.com/complaint-management-sytem/
  # Version: v4.2
  # Tested on: Xampp
  # Credit: İsmail BOZKURT
  
  ------ Details:
  
  1- Vulnerable code is here: http://localhost/cms/users/registration.php
  2- Vulnerable code:
  
  Insert user registration information to the DB without filtering.
  
  if(isset($_POST['submit']))
  {
  $fullname=$_POST['fullname'];
  $email=$_POST['email'];
  $password=md5($_POST['password']);
  $contactno=$_POST['contactno'];
  $status=1;
  $query=mysqli_query($con,"insert into
  users(fullName,userEmail,password,contactNo,status)
  values('$fullname','$email','$password','$contactno','$status')");
  $msg="Registration successfull. Now You can login !";
  }
  ?>
  
  3- In the admin dashboard:
  
  Get fullName from DB and print it without any filtering
  
  <tr>
  <td colspan="2"><b><?php echo $row['fullName'];?>'s profile</b></td>
  </tr>
  
  4- If we insert "fullName" as "script>prompt(2)</script>", we can perform
  this attack as "Stored XSS"
  
  5- Picture in the Attachemnt
  ---------------------------------------------------