User Registration & Login and User Management System With admin panel 2.1 – Persistent XSS

• Exploit Database
• 182 阅读

• 作者： yusufmalikul
  日期： 2020-10-20
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48914/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

  # Exploit Title: User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS # Google Dork: N/A # Date: 2020-08-07 # Exploit Author: yusufmalikul # Vendor Homepage: https://phpgurukul.com # Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ # Version: 2.1 # Tested on: Windows 10 # CVE : N/A   Description   User Registration & Login and User Management System With admin panel 2.1 application from PHPgurukul is vulnerable to Persistent XSS via the fname, lname, email, and contact field name when user register on the site then admin viewing user list on manage user page triggering the payload.   POC   User side 1. Go to the user registration page http://localhost/loginsystem 2. Enter <img src="https://www.exploit-db.com/exploits/48914/x" onerror=alert(document.cookie)> in one of the field (first name, last name, email, or contact) 3. Click sign up   Admin side 1. Login to admin panel http://localhost/loginsystem/admin 2. After login successful it will redirect to manage user page 3. Payload triggered