COVID19 Testing Management System 1.0 – ‘State’ Stored Cross-Site-Scripting (XSS)

• Exploit Database
• 20 阅读

• 作者： BHAVESH KAUL
  日期： 2021-06-14
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49993/

• # Exploit Title: COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)
  # Date: 11/06/2021
  # Exploit Author: BHAVESH KAUL
  # Vendor Homepage: https://phpgurukul.com
  # Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
  # Version: 1.0
  # Tested on: Server: XAMPP
  
  # Description #
  
  COVID19 Testing Management System 1.0 is vulnerable to stored cross site scripting because of insufficient user supplied data sanitization. Anyone can submit a stored XSS payload without login when registering as a new user. This makes the application store our payload in the database and it is fired everything the dashboard is viewed.
  
  # Proof of Concept (PoC) : Exploit #
  
  1) Goto: http://localhost/covid-tms/new-user-testing.php
  2) Enter the following payload in 'State' parameter: <script>alert(1)</script>
  3) Fill out other information and submit query
  4) Now goto: http://localhost/covid-tms/live-test-updates.php
  5) Stored XSS payload is fired
  
  # Image PoC : Reference Image #
  
  1) Vulnerable Parameter: https://ibb.co/1vyNM2w
  2) Payload Fired: https://ibb.co/CsfPnXK