| शीर्षक | Merchandise Online Store System - Stored XSS |
|---|
| विवरण | # Exploit Title: Merchandise Online Store System - Stored XSS
# Exploit Author: Pratik Shetty
# Vendor Name: oretnom23
# Vendor Homepage: https://www.sourcecodester.com/php/14887/merchandise-online-store-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/php/14887/merchandise-online-store-php-free-source-code.html
# Version: v1.0
# Tested on: Parrot GNU/Linux 4.10, Apache
# CVE: ytd
Description:-
A Srored XSS issue in Merchandise Online Store System v.1.0 allows to inject Arbitrary JavaScript in edit account form.
`
Payload used:-
<script>confirm (document.cookie)</script>
`
Parameter:-
"Firstname": <script>confirm (document.cookie)</script>
`
Steps to reproduce:-
1. First login into any user account
2. Go to http://localhost/vloggers_merch/?p=my_account
2. In that go to "Manage Account" and where you can put your "Firstname", edit that and put your payload.
3. Now fill the other details and save it.
4. You can see our xss payload was triggered. |
|---|
| उपयोगकर्ता | draco (UID 24011) |
|---|
| सबमिशन | 13/10/2022 11:53 AM (4 साल पहले) |
|---|
| संयम | 13/10/2022 05:04 PM (5 hours later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 210658 [Merchandise Online Store 1.0 Edit Account Form क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|