提出 #474280: oretnom23 Task Reminder System 0.1 Cross Site Scripting

#Exploit Title: Task Reminder System - Stored XSS

#Exploit Author: Krutika Thakur

#Vendor Name: oretnom23

#Vendor Homepage: https://www.sourcecodester.com/php/16451/task-reminder-system-php-and-mysql-source-code-free-download.html

#Software Link: https://www.sourcecodester.com/php/16451/task-reminder-system-php-and-mysql-source-code-free-download.html

#Tested on: Kali Linux, Xampp

#Description:

A Persistent stored XSS issue in Task Reminder System allows to inject Arbitary JavaScript in "System Name" input, under System Information Update feature.

#Payload: ≋ "><!'/*"*\'/*\"/*--></Script><Image SrcSet=K */; OnError=confirm(54) //># ≋

#Steps:

1) Login as Admin user
2) Under the "Maintenance" Section, we can see "System Information" tab
3) Once we click on "System Information", we see there is the feature to update the name under "System Name".
4) Insert the given payload in the "System Name" input and hit "Update" button below.
5) Once Updated we can see that our payload is executed everywhere, wherever the name is reflected once saved.

• ユーザー: lucifoxer001 (UID 33693)
• 送信: 2025年01月03日 11:44 (2 年 ago)
• モデレーション: 2025年01月14日 09:29 (11 days later)
• ステータス: 承諾済み
• VulDBエントリ: 291481 [SourceCodester Task Reminder System 1.0 Maintenance Section System Name クロスサイトスクリプティング]
• ポイント: 17