| शीर्षक | PHPGurukul Nipah virus (NiV) Testing Management System 1.0 Cross Site Scripting |
|---|
| विवरण | A unauthenticated reflected cross-site scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) – Testing Management System 1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the "Search Report" field.
Steps to Reproduce:
# Exploit Title: Unauthenticated Reflected cross-site scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) – Testing Management System
# Date: 20-11-2023
# Exploit Author: dhabaleshwardas
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/nipah-virus-niv-testing-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: firefox/chrome
# CVE :
To reproduce the attack:
1- Head to the http://localhost/nipah-tms/patient-search-report.php endpoint
2- Here you would be asked to give a value in the "Search By Patient Name or Mobile Number or Order Number" parameter. Simply input a XSS payload: <script>alert(document.cookie)</script>
3- As soon as you hit "Search" the payload would be triggered and "Cookie" would be displayed in a pop-up.
4- Although Reflected XSS is not as critical as Stored XSS but still it can be used to steal user session cookies, allowing the attacker to impersonate the victim and perform actions on their behalf and can even redirect users to malicious websites. |
|---|
| स्रोत | ⚠️ https://github.com/dhabaleshwar/niv_testing_rxss/blob/main/exploit.md |
|---|
| उपयोगकर्ता | dhabaleshwar (UID 58737) |
|---|
| सबमिशन | 21/11/2023 07:04 AM (3 साल पहले) |
|---|
| संयम | 26/11/2023 08:21 AM (5 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 246123 [PHPGurukul Nipah Virus Testing Management System 1.0 Search Report Page patient-search-report.php Search By Patient Name क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|