Seat Reservation System 1.0 Cross Site Scripting

2020.10.09
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: Seat Reservation System 1.0 Persistent Cross-Site Scripting # Date: 10-08-2020 # Exploit Author: George Tsimpidas # Vendor Homepage: www.sourcecodester.com # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/seat-reservation-system-using-php_0.zip # Version: 1.0 # Tested on: Ubuntu 18.04.5 LTS (Bionic Beaver) # Category: Webapp Description : The file movie_list.php does not sanitize correctly the description drop down menu on the edit mode, therefore it echoes out the data on the parsed ID number of the current indicated movie. Culprit : ######################################################################### <div class="dropdown-menu"> <a class="dropdown-item edit_movie" href="javascript:void(0)" data-id = '<?php echo $row['id'] ?>'>Edit</a> ######################################################################### PoC : 1. Navigate on the admin panel and login : http://localhost/seat_reservation/admin/ 2. Go under the category Movie List 3. Click on Edit, and change the description of the Movie "The Matrix" 4. Apply on the description the below payload : <script>alert("XSS")</script> 5. Click save, and visit the main menu : http://localhost/seat_reservation/ 6. Locate the movie " The Matrix " and click Reserve Seat You will be granted with a Cross Site Scripting Alert.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top