Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863549149

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Client Management System 1.1 - 'username' Stored Cross-Site Scripting (XSS)
# Date: 14 June 2021
# Exploit Author: BHAVESH KAUL
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/client-management-system-using-php-mysql/
# Version: 1.1
# Tested on: Server: XAMPP

# Description #

Client Management System 1.1 is vulnerable to stored cross site scripting because of insufficient user supplied data sanitization. 

# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/clientms/admin/index.php
2) Login as admin using test credentials: admin/Test@123
3) Goto: http://localhost/clientms/admin/admin-profile.php
4) Enter the following payload in the user name field: <script>alert(1)</script>
5) Click on Update
6) Our payload is fired and stored