Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86372907

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Online Inventory Manager 3.2 - Persistent Cross-Site Scripting
# Date: 2019-11-29
# Exploit Author: Cemal Cihad ÇİFTÇİ
# Vendor Homepage: https://bigprof.com
# Software Link : https://bigprof.com/appgini/applications/online-inventory-manager
# Software : Online Inventory Manager
# Version : 3.2
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# Tested on: Windows 10 Pro

# Stored XSS has been discovered in the Online Inventory Manager created by bigprof/AppGini
# editgroups section. In editgroups section
# (http://localhost/inventory/admin/pageEditGroup.php?groupID=1).

# Payload i used:
"><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>"

# POC: http://localhost/inventory/admin/pageViewGroups.php in this
# url you can edit the groups information with pressing onto the group name. After the edit page open
# you can enter your payload into the description field. After going back to
# the groups page you will see your Javascript code gonna run.
# This vulnerability is also exist while you are creating a new group.