发布 2020-10-19 漏洞条目

Hostel Management System 2.1 – Cross Site Scripting (Multiple Fields)

Exploit Source

# Exploit Title: PHPGurukul hostel-management-system 2.1 allows XSS via

Guardian Name, Guardian Relation, Guardian Contact no, Address, City

# Google Dork: N/A

# Date: 2020-10-08

# Exploit Author: Kokn3t

# Vendor Homepage: https://phpgurukul.com

# Software Link: https://phpgurukul.com/hostel-management-system

# Version: V 2.1

# Tested on: Windows 10, Kali 2020.1

# CVE : CVE-2020-25270

######## Attack Vector ########

Install Hostel Management System V 2.1

1) User Module

(http:/localhost/hostel/book-hostel.php) and start booking.

Add malicious script in these fields - "<script>alert('XSS');</script>"

i. Guardian Name

ii. Guardian Relation

iii.Guardian Contact no

iv. Address

vi. City

After that will get a prompt "Student Successfully register" and after

pressing "See All", XSS will be triggered.

2) Admin Module

of booked student's record, XSS will be triggered also.

相关漏洞条目