Savsoft Quiz 5 – ‘field_title’ Stored Cross-Site Scripting

• Exploit Database
• 133 阅读

• 作者： Dhruv Patel
  日期： 2020-12-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49196/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

  # Exploit Title: Savsoft Quiz 5 - &apos;field_title&apos; Stored Cross-Site Scripting # Date: 2020-09-02 # Exploit Author: Dhruv Patel(dhruvp111296) # Vendor Homepage: https://savsoftquiz.com/ # Software Link: https://github.com/savsofts/savsoftquiz_v5.git # Version: 5.0 # Tested on: Windows 10   Attack vector: This vulnerability can results attacker to inject the XSS payload in admin panel Custom Field section. And Inject JavaScript Malicious code & Steal User’s cookie   Vulnerable Parameters: title Steps for reproduce: 1. Go to admin panel’s add custom fields page 2. Fill the Title name as <script>alert("HELLO XSS")</script> payload in title. 3. Now Click on Save we can see our payload gets executed. 4. All Users Can Show our Payload As a xss.