| 제목 | PHPGURUKUL Online Security Guards Hiring System 1.0 suffers from Reflected XSS via search-request.php(searchdata parameter) |
|---|
| 설명 | # VULNERABILITY-TYPE : CROSS-SITE SCRIPTING (XSS)
# VENDOR OF THE PRODUCT : PHPGURUKUL
# AFFECTED PRODUCT : Online Security Guards Hiring System
# VERSION: 1.0
# ATTACK TYPE : REMOTE
# IMPACT: CODE EXECUTION
# AFFECTED COMPONENTS: SOURCE-CODE(search-request.php)
# ATTACK VECTOR: REQUEST STATUS(searchdata)
#CREDITS: AFFAN AHMED
# REFERENCES:
1.) http://localhost/osghs/search-request.php
2.) https://cwe.mitre.org/data/definitions/79.html
STEPS_TO_REPRODUCE
1. Navigate to the “Request Status” you will be redirected to [`http://localhost/osghs/search-request.php`](http://localhost/osghs/search-request.php)
2. In Search Booking Section Enter the below payload
3. Payload: "><script>alert(document.domain)</script>
4. We got XSS-trigger
PROOF_OF_CONCEPT
https://github.com/ctflearner/Vulnerability/blob/main/Online-Security-guard-POC.md |
|---|
| 원천 | ⚠️ https://phpgurukul.com/online-security-guards-hiring-system-using-php-and-mysql/ |
|---|
| 사용자 | Affan (UID 39417) |
|---|
| 제출 | 2023. 01. 24. PM 05:57 (4 연령 ago) |
|---|
| 모더레이션 | 2023. 01. 27. AM 11:32 (3 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 219596 [PHPGurukul Online Security Guards Hiring System 1.0 search-request.php searchdata 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|