Customer Support System 1.0 – “First Name” & “Last Name” Stored XSS

• Exploit Database
• 32 阅读

• 作者： Saeed Bala Ahmed
  日期： 2020-12-17
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49275/

• # Exploit Title: Customer Support System 1.0 - "First Name" & "Last Name" Stored XSS
  # Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
  # Date: 2020-12-11
  # Google Dork: N/A
  # Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
  # Software Link: https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
  # Affected Version: Version 1
  # Tested on: Parrot OS
  
  Step 1. Login to the application with any valid credentials
  
  Step 2. Click on the username in header and select "Manage Account".
  
  Step 3. On "Manage Account" page, insert "<script>alert("r0b0tG4nG")</script>" in both the "First Name" & "Last Name" fields.
  
  Step 4. Complete the other required details and click on save to update user information.
  
  Step 5. This should trigger the XSS payloads. Whenever the user logs in with same valid credentials, the XSS payloads will be triggered