User Registration & Login and User Management System v3.0 – Stored Cross-Site Scripting (XSS)

• Exploit Database
• 195 阅读

• 作者： Ashutosh Singh Umath
  日期： 2023-08-24
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51694/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

  # Exploit Title: User Registration & Login and User Management System v3.0 - Stored Cross-Site Scripting (XSS) # Google Dork: NA # Date: 19/08/2023 # Exploit Author: Ashutosh Singh Umath # Vendor Homepage: https://phpgurukul.com # Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ # Version: 3.0 # Tested on: Windows 11 # CVE : Requested     Description   User Registration & Login and User Management System With admin panel 3.0 application from PHPgurukul is vulnerable to Persistent XSS via the fname, lname, email, and contact field name. When User logs in or the admin user logs in the payload gets executed.   POC   User side 1. Go to the user registration page http://localhost/loginsystem. 2. Enter <img src="https://www.exploit-db.com/exploits/51694/x" onerror=alert(document.cookie)> in one of the fields (first name, last name, email, or contact). 3. Click sign up.   Admin side 1. Login to admin panel http://localhost/loginsystem/admin. 2. After login successfully go to manage user page. 3. Payload     Thanks and Regards,   Ashutosh Singh Umath