# Exploit Title: Create-Project Manager 1.07 Multi XSS /HTML injection Vunlerabilities # Google Dork:N/A # Date: 2020-05-06 # Exploit Author: @ThelastVvV # Vendor Homepage: https://codecanyon.net/item/create-project-manager-with-authenticator/20483329?s_rank=3 # Version: 1.6 # Tested on: 5.4.0-kali4-amd64 --------------------------------------------------------- About : Create! freelancer manager is a complete project management solution for developers, freelancers and software companies, it offers powerful tools for project development, tracking each developer work time for each project, generating invoices for online payment, complete social network with chat and news feed for developers, and powerful financial section for income and expenses.. Summary: Multi Persistent Cross-site Scripting and HTML injection in Create 1.07 - Freelancer Project Manager PoC : 1- Go to any of following: A-Online chat B-Social feed C-Message (title-tag) B-Add new client (all-tags) 2- In the text field type your payload : <h1>vvv</h1> <svg onload=confirm()> 3-then hit Enter 4- Once the admin or users receive the message or read /visit the post feed ... they will be xssed Impact: XSS can lead the adminstators & users Session Hijacking,it can also lead to disclosure of sensitive data and other critical attacks on administrators and the webapp directly. Screentshoots: A-Online chat https://i.imgur.com/nNGVoXI.png B-Social feed https://i.imgur.com/yQle2Mn.png C-Message (title-tag) https://i.imgur.com/8usFkJ7.png B-Add new client (all-tags) https://i.imgur.com/oWYA88d.png