| عنوان | PHPGURUKUL Online Security Guards Hiring System 1.0 suffers from Reflected XSS via search-request.php(searchdata parameter) |
|---|
| الوصف | # VULNERABILITY-TYPE : CROSS-SITE SCRIPTING (XSS)
# VENDOR OF THE PRODUCT : PHPGURUKUL
# AFFECTED PRODUCT : Online Security Guards Hiring System
# VERSION: 1.0
# ATTACK TYPE : REMOTE
# IMPACT: CODE EXECUTION
# AFFECTED COMPONENTS: SOURCE-CODE(search-request.php)
# ATTACK VECTOR: REQUEST STATUS(searchdata)
#CREDITS: AFFAN AHMED
# REFERENCES:
1.) http://localhost/osghs/search-request.php
2.) https://cwe.mitre.org/data/definitions/79.html
STEPS_TO_REPRODUCE
1. Navigate to the “Request Status” you will be redirected to [`http://localhost/osghs/search-request.php`](http://localhost/osghs/search-request.php)
2. In Search Booking Section Enter the below payload
3. Payload: "><script>alert(document.domain)</script>
4. We got XSS-trigger
PROOF_OF_CONCEPT
https://github.com/ctflearner/Vulnerability/blob/main/Online-Security-guard-POC.md |
|---|
| المصدر | ⚠️ https://phpgurukul.com/online-security-guards-hiring-system-using-php-and-mysql/ |
|---|
| المستخدم | Affan (UID 39417) |
|---|
| ارسال | 24/01/2023 05:57 PM (4 سنوات منذ) |
|---|
| الاعتدال | 27/01/2023 11:32 AM (3 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 219596 [PHPGurukul Online Security Guards Hiring System 1.0 search-request.php searchdata البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|