| Title | PHPGURUKUL Online Security Guards Hiring System 1.0 suffers from Reflected XSS via search-request.php(searchdata parameter) |
|---|
| Description | # VULNERABILITY-TYPE : CROSS-SITE SCRIPTING (XSS)
# VENDOR OF THE PRODUCT : PHPGURUKUL
# AFFECTED PRODUCT : Online Security Guards Hiring System
# VERSION: 1.0
# ATTACK TYPE : REMOTE
# IMPACT: CODE EXECUTION
# AFFECTED COMPONENTS: SOURCE-CODE(search-request.php)
# ATTACK VECTOR: REQUEST STATUS(searchdata)
#CREDITS: AFFAN AHMED
# REFERENCES:
1.) http://localhost/osghs/search-request.php
2.) https://cwe.mitre.org/data/definitions/79.html
STEPS_TO_REPRODUCE
1. Navigate to the “Request Status” you will be redirected to [`http://localhost/osghs/search-request.php`](http://localhost/osghs/search-request.php)
2. In Search Booking Section Enter the below payload
3. Payload: "><script>alert(document.domain)</script>
4. We got XSS-trigger
PROOF_OF_CONCEPT
https://github.com/ctflearner/Vulnerability/blob/main/Online-Security-guard-POC.md |
|---|
| Source | ⚠️ https://phpgurukul.com/online-security-guards-hiring-system-using-php-and-mysql/ |
|---|
| User | Affan (UID 39417) |
|---|
| Submission | 01/24/2023 17:57 (4 years ago) |
|---|
| Moderation | 01/27/2023 11:32 (3 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 219596 [PHPGurukul Online Security Guards Hiring System 1.0 search-request.php searchdata cross site scripting] |
|---|
| Points | 20 |
|---|