| शीर्षक | AC Repair and Services System - Stored XSS |
|---|
| विवरण | # Exploit Title: AC Repair and Services System v1.0 - Stored XSS
# Exploit Author: Pratik Shetty
# Vendor Name: oretnom23
# Vendor Homepage: https://www.sourcecodester.com/php/16513/ac-repair-and-services-system-using-php-and-mysql-source-code-free-download.html
# Software Link: https://www.sourcecodester.com/php/16513/ac-repair-and-services-system-using-php-and-mysql-source-code-free-download.html
# Version: 1.0
# Tested on: Windows 10, Apache
Description:-
A Stored XSS issue in AC Repair and Services System v1.0 allows to inject Arbitrary JavaScript in Edit in "Last Name",and "Username".
`
Payload used:-
<script>confirm (document.cookie)</script>
`
Parameter":-
Full Name: <script>confirm (document.cookie)</script>
`
Steps to reproduce:-
1. Here we go to : http://localhost/php-acrss/admin/?page=user/manage_user
2. Now in those Parameters "Last name" and "Username" put your payload
3. Fill the other details and save the file
4. As we can see our xss has been triggered. |
|---|
| स्रोत | ⚠️ https://github.com/draco1725/POC/blob/main/Exploit/AC%20Repair%20and%20Services%20System/Stored%20XSS |
|---|
| उपयोगकर्ता | draco (UID 24011) |
|---|
| सबमिशन | 23/07/2023 10:00 PM (3 साल पहले) |
|---|
| संयम | 24/07/2023 07:00 PM (21 hours later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 234013 [SourceCodester AC Repair and Services System 1.0 manage_user firstname/middlename क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|