| Título | PHPGURUKUL Online Security Guards Hiring System 1.0 suffers from Reflected XSS via search-request.php(searchdata parameter) |
|---|
| Descrição | # VULNERABILITY-TYPE : CROSS-SITE SCRIPTING (XSS)
# VENDOR OF THE PRODUCT : PHPGURUKUL
# AFFECTED PRODUCT : Online Security Guards Hiring System
# VERSION: 1.0
# ATTACK TYPE : REMOTE
# IMPACT: CODE EXECUTION
# AFFECTED COMPONENTS: SOURCE-CODE(search-request.php)
# ATTACK VECTOR: REQUEST STATUS(searchdata)
#CREDITS: AFFAN AHMED
# REFERENCES:
1.) http://localhost/osghs/search-request.php
2.) https://cwe.mitre.org/data/definitions/79.html
STEPS_TO_REPRODUCE
1. Navigate to the “Request Status” you will be redirected to [`http://localhost/osghs/search-request.php`](http://localhost/osghs/search-request.php)
2. In Search Booking Section Enter the below payload
3. Payload: "><script>alert(document.domain)</script>
4. We got XSS-trigger
PROOF_OF_CONCEPT
https://github.com/ctflearner/Vulnerability/blob/main/Online-Security-guard-POC.md |
|---|
| Fonte | ⚠️ https://phpgurukul.com/online-security-guards-hiring-system-using-php-and-mysql/ |
|---|
| Utilizador | Affan (UID 39417) |
|---|
| Submissão | 24/01/2023 17h57 (há 4 anos) |
|---|
| Moderação | 27/01/2023 11h32 (3 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 219596 [PHPGurukul Online Security Guards Hiring System 1.0 search-request.php searchdata Script de Site Cruzado] |
|---|
| Pontos | 20 |
|---|